CM-825: release chore: Upstream bump for v1.19.2 and rebase for v1.19.0 release #358
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@PillaiManish: This pull request references CM-825 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
bot
added
the
do-not-merge/work-in-progress
WalkthroughBumps cert-manager v1.18.3→v1.19.2 and Go toolchain 1.24→1.25; upgrades builder images and dependencies; large CRD/OpenAPI schema enrichments (list/map metadata, RFC2136 protocol, podTemplate resources, issuerRef descriptions); bundle/CSV/manifest image and metadata updates; small code, test, and bindata adjustments. Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes 📜 Recent review detailsConfiguration used: Organization UI Review profile: CHILL Plan: Pro Cache: Disabled due to data retention organization setting Knowledge base: Disabled due to 📒 Files selected for processing (2)
🧰 Additional context used📓 Path-based instructions (1)**⚙️ CodeRabbit configuration file
Files:
🔇 Additional comments (2)
Comment |
|
@PillaiManish: This pull request references CM-825 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
PillaiManish
changed the title
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
There was a problem hiding this comment.
Thanks for your work. Some suggestions:
- Could we squash commits cd70d9e and 4e1e232 since they are doing the same thing?
- Along with this commit 7817403, we should also update this line: https://github.com/PillaiManish/cert-manager-operator/blob/e3cf35386610052dd0bf89303ccb4c1e7238d429/config/manifests/bases/cert-manager-operator.clusterserviceversion.yaml#L115
- It would be great if we could still keep the commit messages verbose like what we did in the past.
- Ideally we should bump with 1.19.2 which just got released days ago to reduce future work.
openshift-merge-robot
added
the
needs-rebase
https://github.com/openshift/jetstack-cert-manager/tags right now we dont have the required tag. |
openshift-merge-robot
removed
the
needs-rebase
PillaiManish
changed the title
|
@PillaiManish: This pull request references CM-825 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
🧹 Nitpick comments (5)
.idea/.gitignore (1)
1-8: Consider using repository-root .gitignore or global gitignore instead.IDE-specific configuration directories like
.idea/should typically not be committed to the repository. Different team members may use different IDEs (VS Code, vim, emacs, etc.), and IDE-specific ignore files create unnecessary repository clutter.Consider either:
- Adding these patterns to the repository's root
.gitignorefile, or- Using a global gitignore configuration (
~/.gitignore_global).idea/cert-manager-operator.iml (1)
1-4: Consider adding .idea/ to .gitignore.IDE configuration files are typically user-specific and can cause merge conflicts. Consider excluding the
.idea/directory unless the team has explicitly decided to version-control IDE settings.rebase_automation.sh (3)
13-14: Remove unusedREPO_ROOTvariable.
REPO_ROOTis defined but never referenced in the script. Based on static analysis (SC2034).SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" -REPO_ROOT="$SCRIPT_DIR"
358-361: Word boundary pattern may cause unintended matches.The pattern
\b${old_version}\bcould match version substrings in edge cases (e.g., "1.18.0" within a hypothetical "v1.18.0-rc1" or similar). Consider using more restrictive anchoring if precision is critical.
314-320: Array assignment from command substitution is fragile for filenames with spaces.Shellcheck SC2207: If any file has spaces or newlines in its name, word splitting will corrupt the array. In this OpenShift repo context, this is unlikely, but using
mapfilewith null-delimited find would be more robust.- local files_to_check=( - $(find . -type f \( -name "*.go" -o -name "*.yaml" -o -name "*.yml" -o -name "*.json" -o -name "*.md" -o -name "*.Dockerfile" \) \ - -not -path "./vendor/*" \ - -not -path "./.git/*" \ - -not -path "./testbin/*" \ - | grep -v "go.sum") - ) + local files_to_check=() + while IFS= read -r -d '' file; do + [[ "$file" != *"go.sum"* ]] && files_to_check+=("$file") + done < <(find . -type f \( -name "*.go" -o -name "*.yaml" -o -name "*.yml" -o -name "*.json" -o -name "*.md" -o -name "*.Dockerfile" \) \ + -not -path "./vendor/*" \ + -not -path "./.git/*" \ + -not -path "./testbin/*" \ + -print0)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting
⛔ Files ignored due to path filters (215)
go.sumis excluded by!**/*.sumvendor/cel.dev/expr/.bazelversionis excluded by!vendor/**,!**/vendor/**vendor/cel.dev/expr/MODULE.bazelis excluded by!vendor/**,!**/vendor/**vendor/cel.dev/expr/README.mdis excluded by!vendor/**,!**/vendor/**vendor/cel.dev/expr/cloudbuild.yamlis excluded by!vendor/**,!**/vendor/**vendor/cel.dev/expr/eval.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/CHANGES.mdis excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/auth.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/credentials/detect.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/credentials/filetypes.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/externalaccount.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/x509_provider.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/internal/credsfile/filetype.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/internal/transport/cba.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/internal/transport/cert/workload_cert.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/compute/metadata/CHANGES.mdis excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/compute/metadata/metadata.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/compute/metadata/retry.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/compute/metadata/syscheck.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/compute/metadata/syscheck_linux.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/compute/metadata/syscheck_windows.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/Masterminds/semver/v3/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/Masterminds/semver/v3/README.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/Masterminds/semver/v3/constraints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/Masterminds/semver/v3/version.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/auth_scheme_preference.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/config.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/env_config.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/load_options.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/provider.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/resolve.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/resolve_credentials.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/shared_config.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds/provider.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/endpointcreds/provider.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/processcreds/provider.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/ssocreds/sso_credentials_provider.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/static_provider.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/stscreds/assume_role_provider.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/stscreds/web_identity_provider.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/api_client.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/ini/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/ini/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_client.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_GetRoleCredentials.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_ListAccountRoles.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_ListAccounts.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_Logout.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/auth.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/deserializers.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/endpoints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/generated.jsonis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/internal/endpoints/endpoints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/options.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/serializers.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_client.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_CreateToken.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_CreateTokenWithIAM.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_RegisterClient.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_StartDeviceAuthorization.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/auth.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/deserializers.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/doc.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/endpoints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/generated.jsonis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/internal/endpoints/endpoints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/options.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/types/enums.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/types/errors.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/types/types.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_client.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRole.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoleWithSAML.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoleWithWebIdentity.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoot.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_DecodeAuthorizationMessage.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetAccessKeyInfo.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetCallerIdentity.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetFederationToken.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetSessionToken.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/auth.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/deserializers.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/endpoints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/generated.jsonis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/internal/endpoints/endpoints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/options.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/serializers.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/types/errors.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/validators.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v4/context.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v4/exponential.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v4/retry.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v4/tries.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v5/.gitignoreis excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v5/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v5/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v5/README.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v5/backoff.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v5/error.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v5/exponential.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v5/retry.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v5/ticker.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v5/timer.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/LICENSESis excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/acme/v1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/acme/v1/types_challenge.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/acme/v1/types_issuer.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/acme/v1/types_order.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/acme/v1/zz_generated.deepcopy.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1/types_certificate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1/types_certificaterequest.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1/types_issuer.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/meta/doc.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/meta/v1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/meta/v1/types.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/meta/v1/zz_generated.deepcopy.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeauthorization.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallenge.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallengesolver.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallengesolverdns01.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallengesolverhttp01.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallengesolverhttp01gatewayhttproute.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallengesolverhttp01ingress.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallengesolverhttp01ingressobjectmeta.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallengesolverhttp01ingresspodobjectmeta.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallengesolverhttp01ingresspodresources.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallengesolverhttp01ingresspodsecuritycontext.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallengesolverhttp01ingresspodspec.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallengesolverhttp01ingresspodtemplate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallengesolverhttp01ingresstemplate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeexternalaccountbinding.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeissuer.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeissuerdns01provideracmedns.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeissuerdns01providerakamai.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeissuerdns01providerazuredns.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeissuerdns01providerclouddns.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeissuerdns01providercloudflare.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeissuerdns01providerdigitalocean.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeissuerdns01providerrfc2136.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeissuerdns01providerroute53.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeissuerdns01providerwebhook.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeissuerstatus.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/azuremanagedidentity.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/certificatednsnameselector.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/challenge.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/challengespec.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/challengestatus.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/order.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/orderspec.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/orderstatus.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/route53auth.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/route53kubernetesauth.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/serviceaccountref.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/caissuer.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/certificate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/certificateadditionaloutputformat.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/certificatecondition.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/certificatekeystores.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/certificateprivatekey.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/certificaterequest.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/certificaterequestcondition.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/certificaterequestspec.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/certificaterequeststatus.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/certificatesecrettemplate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/certificatespec.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/certificatestatus.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/clusterissuer.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/issuer.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/issuercondition.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/issuerconfig.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/issuerspec.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/issuerstatus.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/jkskeystore.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/nameconstraintitem.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/nameconstraints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/othername.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/pkcs12keystore.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/selfsignedissuer.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/serviceaccountref.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/vaultapprole.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/vaultauth.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/vaultclientcertificateauth.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/vaultissuer.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/vaultkubernetesauth.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/venaficloud.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/venafiissuer.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/venafitpp.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/x509subject.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/internal/internal.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/meta/v1/issuerreference.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/meta/v1/localobjectreference.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/meta/v1/secretkeyselector.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/clientset/versioned/typed/acme/v1/acme_client.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/clientset/versioned/typed/acme/v1/challenge.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/clientset/versioned/typed/acme/v1/order.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/clientset/versioned/typed/certmanager/v1/certificate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/clientset/versioned/typed/certmanager/v1/certificaterequest.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/clientset/versioned/typed/certmanager/v1/certmanager_client.gois excluded by!vendor/**,!**/vendor/**
📒 Files selected for processing (85)
.ci-operator.yaml(1 hunks).idea/.gitignore(1 hunks).idea/cert-manager-operator.iml(1 hunks).idea/golinter.xml(1 hunks).idea/vcs.xml(1 hunks)Dockerfile(1 hunks)Makefile(2 hunks)api/operator/v1alpha1/zz_generated.deepcopy.go(1 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-cr.yaml(1 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-crb.yaml(1 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-deployment.yaml(3 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-leaderelection-rb.yaml(1 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-leaderelection-role.yaml(1 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-sa.yaml(1 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-svc.yaml(1 hunks)bindata/cert-manager-deployment/cert-manager/cert-manager-controller-approve-cert-manager-io-cr.yaml(1 hunks)bindata/cert-manager-deployment/cert-manager/cert-manager-controller-approve-cert-manager-io-crb.yaml(1 hunks)bindata/cert-manager-deployment/cert-manager/cert-manager-controller-certificatesigningrequests-cr.yaml(1 hunks)bindata/cert-manager-deployment/cert-manager/cert-manager-controller-certificatesigningrequests-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-cluster-view-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-certificates-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-certificates-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-challenges-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-challenges-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-clusterissuers-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-clusterissuers-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-ingress-shim-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-ingress-shim-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-issuers-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-issuers-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-orders-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-orders-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-deployment.yaml(3 hunks)bindata/cert-manager-deployment/controller/cert-manager-edit-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-leaderelection-rb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-leaderelection-role.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-sa.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-svc.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-tokenrequest-rb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-tokenrequest-role.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-view-cr.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-deployment.yaml(3 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-dynamic-serving-rb.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-dynamic-serving-role.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-mutatingwebhookconfiguration.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-sa.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-subjectaccessreviews-cr.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-subjectaccessreviews-crb.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-svc.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-validatingwebhookconfiguration.yaml(1 hunks)bundle.Dockerfile(1 hunks)bundle/manifests/acme.cert-manager.io_challenges.yaml(19 hunks)bundle/manifests/acme.cert-manager.io_orders.yaml(6 hunks)bundle/manifests/cert-manager-operator.clusterserviceversion.yaml(4 hunks)bundle/manifests/cert-manager.io_certificaterequests.yaml(5 hunks)bundle/manifests/cert-manager.io_certificates.yaml(14 hunks)bundle/manifests/cert-manager.io_clusterissuers.yaml(25 hunks)bundle/manifests/cert-manager.io_issuers.yaml(25 hunks)bundle/manifests/operator.openshift.io_certmanagers.yaml(7 hunks)bundle/manifests/operator.openshift.io_istiocsrs.yaml(4 hunks)bundle/metadata/annotations.yaml(1 hunks)config/crd/bases/certificaterequests.cert-manager.io-crd.yaml(5 hunks)config/crd/bases/certificates.cert-manager.io-crd.yaml(14 hunks)config/crd/bases/challenges.acme.cert-manager.io-crd.yaml(19 hunks)config/crd/bases/clusterissuers.cert-manager.io-crd.yaml(25 hunks)config/crd/bases/issuers.cert-manager.io-crd.yaml(25 hunks)config/crd/bases/operator.openshift.io_certmanagers.yaml(7 hunks)config/crd/bases/operator.openshift.io_istiocsrs.yaml(4 hunks)config/crd/bases/orders.acme.cert-manager.io-crd.yaml(6 hunks)config/manager/manager.yaml(1 hunks)config/manifests/bases/cert-manager-operator.clusterserviceversion.yaml(3 hunks)go.mod(11 hunks)images/ci/Dockerfile(1 hunks)images/ci/operand.Dockerfile(1 hunks)pkg/controller/deployment/cert_manager_controller_deployment.go(1 hunks)pkg/controller/deployment/deployment_overrides_test.go(3 hunks)pkg/controller/istiocsr/deployments_test.go(1 hunks)pkg/operator/applyconfigurations/internal/internal.go(1 hunks)pkg/operator/applyconfigurations/operator/v1alpha1/certmanager.go(2 hunks)pkg/operator/applyconfigurations/operator/v1alpha1/certmanagerconfig.go(2 hunks)pkg/operator/applyconfigurations/operator/v1alpha1/istiocsr.go(2 hunks)pkg/operator/applyconfigurations/utils.go(2 hunks)pkg/operator/assets/bindata.go(51 hunks)pkg/operator/clientset/versioned/fake/clientset_generated.go(1 hunks)rebase_automation.sh(1 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
**
⚙️ CodeRabbit configuration file
-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.
Files:
bindata/cert-manager-deployment/controller/cert-manager-controller-certificates-crb.yamlbundle.Dockerfilepkg/operator/clientset/versioned/fake/clientset_generated.gobindata/cert-manager-deployment/controller/cert-manager-controller-issuers-cr.yamlbindata/cert-manager-deployment/controller/cert-manager-leaderelection-role.yamlimages/ci/Dockerfilebindata/cert-manager-deployment/webhook/cert-manager-webhook-validatingwebhookconfiguration.yamlbindata/cert-manager-deployment/cert-manager/cert-manager-controller-approve-cert-manager-io-crb.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-clusterissuers-crb.yamlbindata/cert-manager-deployment/webhook/cert-manager-webhook-svc.yamlbindata/cert-manager-deployment/webhook/cert-manager-webhook-dynamic-serving-rb.yamlbindata/cert-manager-deployment/controller/cert-manager-edit-cr.yamlbindata/cert-manager-deployment/controller/cert-manager-leaderelection-rb.yamlbindata/cert-manager-deployment/cainjector/cert-manager-cainjector-svc.yamlpkg/operator/applyconfigurations/utils.goimages/ci/operand.Dockerfilebindata/cert-manager-deployment/webhook/cert-manager-webhook-subjectaccessreviews-crb.yamlbindata/cert-manager-deployment/cert-manager/cert-manager-controller-certificatesigningrequests-crb.yamlconfig/manager/manager.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-ingress-shim-crb.yamlpkg/operator/applyconfigurations/operator/v1alpha1/certmanagerconfig.goDockerfileapi/operator/v1alpha1/zz_generated.deepcopy.gobindata/cert-manager-deployment/cainjector/cert-manager-cainjector-sa.yamlbindata/cert-manager-deployment/webhook/cert-manager-webhook-sa.yamlgo.modbindata/cert-manager-deployment/controller/cert-manager-controller-orders-crb.yamlbundle/manifests/cert-manager.io_certificates.yamlbundle/metadata/annotations.yamlbindata/cert-manager-deployment/cainjector/cert-manager-cainjector-leaderelection-rb.yamlbindata/cert-manager-deployment/cert-manager/cert-manager-controller-approve-cert-manager-io-cr.yamlbindata/cert-manager-deployment/controller/cert-manager-deployment.yamlbindata/cert-manager-deployment/cert-manager/cert-manager-controller-certificatesigningrequests-cr.yamlpkg/controller/istiocsr/deployments_test.gobindata/cert-manager-deployment/controller/cert-manager-controller-certificates-cr.yamlMakefilebindata/cert-manager-deployment/cainjector/cert-manager-cainjector-crb.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-clusterissuers-cr.yamlbindata/cert-manager-deployment/webhook/cert-manager-webhook-dynamic-serving-role.yamlbindata/cert-manager-deployment/controller/cert-manager-sa.yamlpkg/operator/applyconfigurations/operator/v1alpha1/istiocsr.gobindata/cert-manager-deployment/webhook/cert-manager-webhook-mutatingwebhookconfiguration.yamlbindata/cert-manager-deployment/controller/cert-manager-svc.yamlbundle/manifests/acme.cert-manager.io_challenges.yamlconfig/crd/bases/certificaterequests.cert-manager.io-crd.yamlbindata/cert-manager-deployment/cainjector/cert-manager-cainjector-cr.yamlpkg/controller/deployment/cert_manager_controller_deployment.gobindata/cert-manager-deployment/webhook/cert-manager-webhook-deployment.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-challenges-cr.yamlpkg/controller/deployment/deployment_overrides_test.gorebase_automation.shbindata/cert-manager-deployment/cainjector/cert-manager-cainjector-leaderelection-role.yamlbindata/cert-manager-deployment/controller/cert-manager-cluster-view-cr.yamlbindata/cert-manager-deployment/controller/cert-manager-view-cr.yamlbundle/manifests/cert-manager.io_certificaterequests.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-challenges-crb.yamlconfig/crd/bases/issuers.cert-manager.io-crd.yamlconfig/crd/bases/operator.openshift.io_istiocsrs.yamlbundle/manifests/cert-manager.io_issuers.yamlbundle/manifests/operator.openshift.io_istiocsrs.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-issuers-crb.yamlbindata/cert-manager-deployment/webhook/cert-manager-webhook-subjectaccessreviews-cr.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-orders-cr.yamlbindata/cert-manager-deployment/controller/cert-manager-tokenrequest-rb.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-ingress-shim-cr.yamlbindata/cert-manager-deployment/cainjector/cert-manager-cainjector-deployment.yamlconfig/manifests/bases/cert-manager-operator.clusterserviceversion.yamlpkg/operator/applyconfigurations/operator/v1alpha1/certmanager.goconfig/crd/bases/challenges.acme.cert-manager.io-crd.yamlconfig/crd/bases/clusterissuers.cert-manager.io-crd.yamlbundle/manifests/acme.cert-manager.io_orders.yamlbundle/manifests/cert-manager.io_clusterissuers.yamlbundle/manifests/cert-manager-operator.clusterserviceversion.yamlbindata/cert-manager-deployment/controller/cert-manager-tokenrequest-role.yamlconfig/crd/bases/operator.openshift.io_certmanagers.yamlconfig/crd/bases/orders.acme.cert-manager.io-crd.yamlconfig/crd/bases/certificates.cert-manager.io-crd.yamlbundle/manifests/operator.openshift.io_certmanagers.yamlpkg/operator/assets/bindata.gopkg/operator/applyconfigurations/internal/internal.go
🪛 Shellcheck (0.11.0)
rebase_automation.sh
[warning] 14-14: REPO_ROOT appears unused. Verify use (or export if used externally).
(SC2034)
[warning] 143-143: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 197-197: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 198-198: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 272-272: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 273-273: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 280-280: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 281-281: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 315-319: Prefer mapfile or read -a to split command output (or quote to avoid splitting).
(SC2207)
[warning] 335-335: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 407-407: Prefer mapfile or read -a to split command output (or quote to avoid splitting).
(SC2207)
| compute a sum by iterating through the elements of this field and subtracting | ||
| "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the | ||
| node(s) with the highest sum are the most preferred. |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, let's check the file exists and read the specific lines
cd bundle/manifests && ls -la acme.cert-manager.io_challenges.yaml 2>/dev/null || cd ../.. && ls -la bundle/manifests/acme.cert-manager.io_challenges.yamlRepository: openshift/cert-manager-operator
Length of output: 280
🏁 Script executed:
# Read lines around 1435-1437
sed -n '1430,1445p' bundle/manifests/acme.cert-manager.io_challenges.yamlRepository: openshift/cert-manager-operator
Length of output: 1599
🏁 Script executed:
# Read lines around 2738-2740
sed -n '2733,2750p' bundle/manifests/acme.cert-manager.io_challenges.yamlRepository: openshift/cert-manager-operator
Length of output: 1751
🌐 Web query:
Kubernetes WeightedPodAffinityTerm documentation weight calculation subtract or add
💡 Result:
The weight is added (summed) to the node's score — Kubernetes iterates preferred rules a node satisfies and adds each rule's weight to the node's score (it is not subtracted). [1][2]
Sources:
[1] Kubernetes docs — Assigning Pods to Nodes (pod/node affinity weight described).
[2] Kubernetes v1.33 docs — node/pod affinity preferred weight explanation.
Fix contradictory PodAntiAffinity documentation: change "subtracting" to "adding"
The current text states the scheduler computes "a sum by iterating through the elements of this field and subtracting weight from the sum," but then concludes "the node(s) with the highest sum are the most preferred." This is contradictory—subtracting weight would make lower sums preferred. Kubernetes documentation explicitly states that weights are added per-node to find the most preferred node(s), not subtracted.
- compute a sum by iterating through the elements of this field and subtracting
- "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+ compute a sum by iterating through the elements of this field and adding
+ "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; theAlso applies to: 2738-2740
🤖 Prompt for AI Agents
In bundle/manifests/acme.cert-manager.io_challenges.yaml around lines 1435-1437
(and also apply the same change at lines 2738-2740), update the PodAntiAffinity
description to remove the contradiction by replacing the term "subtracting
weight from the sum" with "adding weight to the sum"; ensure the sentence reads
that the scheduler computes a sum by iterating through the elements of this
field and adding the corresponding "weight" when a node has matching pods so
that the node(s) with the highest sum are the most preferred.
| compute a sum by iterating through the elements of this field and subtracting | ||
| "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the | ||
| node(s) with the highest sum are the most preferred. |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, let's read the file to see the exact content at the specified lines
wc -l config/crd/bases/issuers.cert-manager.io-crd.yamlRepository: openshift/cert-manager-operator
Length of output: 129
🏁 Script executed:
# Read lines around 1472-1474 to see the full context
sed -n '1465,1480p' config/crd/bases/issuers.cert-manager.io-crd.yamlRepository: openshift/cert-manager-operator
Length of output: 1864
🏁 Script executed:
# Read lines around 2683-2685 to see the full context
sed -n '2676,2691p' config/crd/bases/issuers.cert-manager.io-crd.yamlRepository: openshift/cert-manager-operator
Length of output: 1864
🌐 Web query:
Kubernetes PodAntiAffinity weight preferredDuringSchedulingIgnoredDuringExecution documentation
💡 Result:
-
What it is: the weight field on a preferredDuringSchedulingIgnoredDuringExecution podAntiAffinity rule gives that rule a numeric importance (soft preference) used by the scheduler when scoring nodes. [1]
-
Semantics: for each node that satisfies the pod’s other scheduling requirements, the scheduler iterates every preferred podAffinity/podAntiAffinity rule that the node satisfies and adds that rule’s weight to the node’s score; nodes with higher total score are preferred. The rule remains "soft" — it can be violated if no node meets the preference. [1][2]
-
Value/range: integer 1–100. [1]
-
Key bits to include in YAML:
- podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution: a list of {weight, podAffinityTerm}
- podAffinityTerm contains labelSelector and topologyKey (topologyKey cannot be empty for pod anti-affinity). Example: weight: 100 with topologyKey: topology.kubernetes.io/zone. [1][2]
Sources: [1] Kubernetes docs — Assigning Pods to Nodes (pod affinity/anti‑affinity and weight). [2] Kubernetes v1.32 docs / examples.
🏁 Script executed:
# Look for upstream cert-manager types or schema
find . -name "*.go" -type f | head -20Repository: openshift/cert-manager-operator
Length of output: 939
🌐 Web query:
cert-manager upstream issuer CRD PodAntiAffinity weight types
💡 Result:
In cert-manager’s upstream Issuer/ClusterIssuer PodAntiAffinity CRD the "weight" field is an integer (int32) in the range 1–100 used on Preferred (preferredDuringSchedulingIgnoredDuringExecution) rules; Required rules (requiredDuringSchedulingIgnoredDuringExecution) do not use a weight. [1][2]
Sources:
[1] cert-manager CRD schema showing podAntiAffinity weight as integer 1–100.
[2] cert-manager/clusterissuer CRD docs listing preferred vs required affinity and weight semantics.
🏁 Script executed:
# Check if there's any indication this file is generated
head -20 config/crd/bases/issuers.cert-manager.io-crd.yamlRepository: openshift/cert-manager-operator
Length of output: 626
🏁 Script executed:
# Let's check the git history or any comments about how this file is maintained
head -100 config/crd/bases/issuers.cert-manager.io-crd.yaml | tail -80Repository: openshift/cert-manager-operator
Length of output: 4260
🏁 Script executed:
# Search for any scripts or docs that manage this CRD file
find . -name "*.md" -o -name "*.sh" | xargs grep -l "issuers.cert-manager.io-crd" 2>/dev/null | head -5Repository: openshift/cert-manager-operator
Length of output: 57
🌐 Web query:
cert-manager 1.19.2 upstream Issuer CRD PodAntiAffinity description subtracting adding
💡 Result:
Short answer: the upstream cert-manager v1.19.x CRDs include an Issuer/ClusterIssuer schema field podAntiAffinity (with the standard Kubernetes podAntiAffinity description and properties). This was present in the generated CRD templates used by the chart/CRD YAML (see the podAntiAffinity description and preferredDuringSchedulingIgnoredDuringExecution text). See the cert-manager releases/docs and the CRD template showing the podAntiAffinity description. [1][2]
Sources:
- cert-manager v1.19 release notes. [1]
- cert-manager CRD template showing podAntiAffinity description/properties (charts/templates/crds.yaml). [2]
🏁 Script executed:
# Let's look at the exact context around both locations to understand the internal contradiction
sed -n '1468,1485p' config/crd/bases/issuers.cert-manager.io-crd.yaml | cat -nRepository: openshift/cert-manager-operator
Length of output: 2146
🏁 Script executed:
# Check the second location as well
sed -n '2679,2696p' config/crd/bases/issuers.cert-manager.io-crd.yaml | cat -nRepository: openshift/cert-manager-operator
Length of output: 2146
🌐 Web query:
cert-manager v1.19.2 upstream source code issuer_types podAntiAffinity weight
💡 Result:
In cert-manager v1.19.2 the Issuer/ClusterIssuer pod template affinity fields reuse Kubernetes' core/v1 PodAffinity/PodAntiAffinity types; the "weight" is the Kubernetes WeightedPodAffinityTerm.weight (an int32 in range 1–100). [1][2]
Sources:
- cert-manager API types (pkg/apis/certmanager/v1) — cert-manager uses k8s PodTemplateSpec/Affinity types. [1]
- Kubernetes core/v1 WeightedPodAffinityTerm: Weight int32 (range 1–100). [2]
🏁 Script executed:
# Let's verify this is indeed generated from upstream by checking for generation markers
grep -i "generated\|autogenerated\|do not edit" config/crd/bases/issuers.cert-manager.io-crd.yaml | head -5Repository: openshift/cert-manager-operator
Length of output: 158
🏁 Script executed:
# Check if there's a script or make target that regenerates this CRD
find . -name "Makefile" -o -name "*.mk" | xargs grep -l "crd\|generate" 2>/dev/null | head -3Repository: openshift/cert-manager-operator
Length of output: 85
🏁 Script executed:
# Check the Makefile for CRD generation targets
cat Makefile | grep -A 10 -B 2 "crd\|generate" | head -60Repository: openshift/cert-manager-operator
Length of output: 3118
🏁 Script executed:
# Look for any documentation about the CRD source
find . -name "*.md" | xargs grep -l "CRD\|crd" 2>/dev/null | head -3Repository: openshift/cert-manager-operator
Length of output: 86
🏁 Script executed:
# Let's check the README for more context about upstream sources
head -50 README.mdRepository: openshift/cert-manager-operator
Length of output: 1895
🏁 Script executed:
# Let's verify the exact Kubernetes upstream documentation behavior with a final check
# Looking at the structure - the main description contradicts the items description
# Let's see both full descriptions in context
sed -n '1450,1500p' config/crd/bases/issuers.cert-manager.io-crd.yaml | grep -A 20 "preferredDuringScheduling"Repository: openshift/cert-manager-operator
Length of output: 2359
PodAntiAffinity weight description uses "subtracting" but should use "adding"
Lines 1472–1474 (and 2683–2685) describe the scheduler as "subtracting 'weight'" when in fact it adds weights to the node score. This contradicts both the Kubernetes upstream documentation and the immediately following description in the same CRD (at the items level) which correctly states "The weights... are added per-node." The scheduler selects the node with the highest sum of added weights, not subtracted ones. Since this file is generated from cert-manager v1.19.2, this error likely originates in the upstream schema and should be fixed there and regenerated rather than hand-edited downstream.
🤖 Prompt for AI Agents
In config/crd/bases/issuers.cert-manager.io-crd.yaml around lines 1472-1474 (and
also 2683-2685), the PodAntiAffinity description incorrectly says the scheduler
"subtracts" the weight when computing node scores; change the wording to state
that the weights are "added" to the per-node sum and that the scheduler selects
the node(s) with the highest total, and then regenerate this CRD from the
corrected cert-manager v1.19.2 schema upstream (or fix the upstream schema and
re-run the CRD generation) so the correction is applied consistently rather than
hand-editing the generated file.
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (2)
config/crd/bases/issuers.cert-manager.io-crd.yaml (1)
1472-1474: PodAntiAffinity weight description still uses “subtracting” instead of “adding”These descriptions say the scheduler subtracts
weightper matched term, but Kubernetes actually adds weights to compute node scores, and the surrounding text already speaks about the “greatest sum of weights.” This is a documentation inconsistency with scheduler behavior and the item-level description just below.Consider aligning both blocks with the wording used for
podAffinity/nodeAffinity(i.e., weights are added to the per-node sum) in the upstream schema or generator, then regenerating this CRD rather than hand-editing the generated YAML.Also applies to: 2683-2685
bundle/manifests/acme.cert-manager.io_challenges.yaml (1)
1427-1437: Fix podAntiAffinity weight description: “subtracting” should be “adding”The description currently says the scheduler computes a sum by subtracting weight, yet concludes that nodes with the highest sum are preferred. In reality, weights are added per matching term; the current text is self‑contradictory.
- compute a sum by iterating through the elements of this field and subtracting - "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; theApply the same change in both occurrences (Line 1435-1437 and Line 2738-2740).
Also applies to: 2730-2740
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (80)
.ci-operator.yaml(1 hunks)Dockerfile(1 hunks)Makefile(2 hunks)api/operator/v1alpha1/zz_generated.deepcopy.go(1 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-cr.yaml(1 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-crb.yaml(1 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-deployment.yaml(3 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-leaderelection-rb.yaml(1 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-leaderelection-role.yaml(1 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-sa.yaml(1 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-svc.yaml(1 hunks)bindata/cert-manager-deployment/cert-manager/cert-manager-controller-approve-cert-manager-io-cr.yaml(1 hunks)bindata/cert-manager-deployment/cert-manager/cert-manager-controller-approve-cert-manager-io-crb.yaml(1 hunks)bindata/cert-manager-deployment/cert-manager/cert-manager-controller-certificatesigningrequests-cr.yaml(1 hunks)bindata/cert-manager-deployment/cert-manager/cert-manager-controller-certificatesigningrequests-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-cluster-view-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-certificates-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-certificates-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-challenges-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-challenges-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-clusterissuers-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-clusterissuers-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-ingress-shim-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-ingress-shim-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-issuers-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-issuers-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-orders-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-orders-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-deployment.yaml(3 hunks)bindata/cert-manager-deployment/controller/cert-manager-edit-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-leaderelection-rb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-leaderelection-role.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-sa.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-svc.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-tokenrequest-rb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-tokenrequest-role.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-view-cr.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-deployment.yaml(3 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-dynamic-serving-rb.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-dynamic-serving-role.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-mutatingwebhookconfiguration.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-sa.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-subjectaccessreviews-cr.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-subjectaccessreviews-crb.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-svc.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-validatingwebhookconfiguration.yaml(1 hunks)bundle.Dockerfile(1 hunks)bundle/manifests/acme.cert-manager.io_challenges.yaml(19 hunks)bundle/manifests/acme.cert-manager.io_orders.yaml(6 hunks)bundle/manifests/cert-manager-operator.clusterserviceversion.yaml(5 hunks)bundle/manifests/cert-manager.io_certificaterequests.yaml(5 hunks)bundle/manifests/cert-manager.io_certificates.yaml(14 hunks)bundle/manifests/cert-manager.io_clusterissuers.yaml(25 hunks)bundle/manifests/cert-manager.io_issuers.yaml(25 hunks)bundle/manifests/operator.openshift.io_certmanagers.yaml(7 hunks)bundle/manifests/operator.openshift.io_istiocsrs.yaml(4 hunks)bundle/metadata/annotations.yaml(1 hunks)config/crd/bases/certificaterequests.cert-manager.io-crd.yaml(5 hunks)config/crd/bases/certificates.cert-manager.io-crd.yaml(14 hunks)config/crd/bases/challenges.acme.cert-manager.io-crd.yaml(19 hunks)config/crd/bases/clusterissuers.cert-manager.io-crd.yaml(25 hunks)config/crd/bases/issuers.cert-manager.io-crd.yaml(25 hunks)config/crd/bases/operator.openshift.io_certmanagers.yaml(7 hunks)config/crd/bases/operator.openshift.io_istiocsrs.yaml(4 hunks)config/crd/bases/orders.acme.cert-manager.io-crd.yaml(6 hunks)config/manager/manager.yaml(1 hunks)config/manifests/bases/cert-manager-operator.clusterserviceversion.yaml(4 hunks)go.mod(11 hunks)images/ci/Dockerfile(1 hunks)images/ci/operand.Dockerfile(1 hunks)pkg/controller/deployment/cert_manager_controller_deployment.go(1 hunks)pkg/controller/deployment/deployment_overrides_test.go(3 hunks)pkg/controller/istiocsr/deployments_test.go(1 hunks)pkg/operator/applyconfigurations/internal/internal.go(1 hunks)pkg/operator/applyconfigurations/operator/v1alpha1/certmanager.go(2 hunks)pkg/operator/applyconfigurations/operator/v1alpha1/certmanagerconfig.go(2 hunks)pkg/operator/applyconfigurations/operator/v1alpha1/istiocsr.go(2 hunks)pkg/operator/applyconfigurations/utils.go(2 hunks)pkg/operator/assets/bindata.go(51 hunks)pkg/operator/clientset/versioned/fake/clientset_generated.go(1 hunks)
✅ Files skipped from review due to trivial changes (1)
- bindata/cert-manager-deployment/cert-manager/cert-manager-controller-approve-cert-manager-io-crb.yaml
🚧 Files skipped from review as they are similar to previous changes (39)
- bindata/cert-manager-deployment/controller/cert-manager-controller-clusterissuers-cr.yaml
- config/manager/manager.yaml
- .ci-operator.yaml
- bindata/cert-manager-deployment/webhook/cert-manager-webhook-validatingwebhookconfiguration.yaml
- bindata/cert-manager-deployment/controller/cert-manager-view-cr.yaml
- bindata/cert-manager-deployment/controller/cert-manager-tokenrequest-rb.yaml
- bundle.Dockerfile
- bindata/cert-manager-deployment/webhook/cert-manager-webhook-mutatingwebhookconfiguration.yaml
- pkg/controller/deployment/cert_manager_controller_deployment.go
- bindata/cert-manager-deployment/controller/cert-manager-controller-issuers-cr.yaml
- bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-crb.yaml
- pkg/controller/istiocsr/deployments_test.go
- bindata/cert-manager-deployment/controller/cert-manager-tokenrequest-role.yaml
- api/operator/v1alpha1/zz_generated.deepcopy.go
- bindata/cert-manager-deployment/controller/cert-manager-controller-challenges-crb.yaml
- bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-sa.yaml
- bindata/cert-manager-deployment/webhook/cert-manager-webhook-dynamic-serving-role.yaml
- bindata/cert-manager-deployment/webhook/cert-manager-webhook-dynamic-serving-rb.yaml
- bindata/cert-manager-deployment/controller/cert-manager-controller-certificates-cr.yaml
- pkg/operator/applyconfigurations/operator/v1alpha1/istiocsr.go
- pkg/operator/applyconfigurations/utils.go
- bindata/cert-manager-deployment/controller/cert-manager-controller-orders-cr.yaml
- images/ci/Dockerfile
- config/crd/bases/operator.openshift.io_istiocsrs.yaml
- bindata/cert-manager-deployment/controller/cert-manager-leaderelection-rb.yaml
- config/crd/bases/certificaterequests.cert-manager.io-crd.yaml
- bindata/cert-manager-deployment/cert-manager/cert-manager-controller-approve-cert-manager-io-cr.yaml
- bindata/cert-manager-deployment/controller/cert-manager-leaderelection-role.yaml
- pkg/operator/applyconfigurations/internal/internal.go
- bindata/cert-manager-deployment/controller/cert-manager-controller-clusterissuers-crb.yaml
- bindata/cert-manager-deployment/webhook/cert-manager-webhook-sa.yaml
- bindata/cert-manager-deployment/webhook/cert-manager-webhook-svc.yaml
- bundle/manifests/cert-manager-operator.clusterserviceversion.yaml
- bindata/cert-manager-deployment/controller/cert-manager-edit-cr.yaml
- pkg/operator/clientset/versioned/fake/clientset_generated.go
- bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-deployment.yaml
- Dockerfile
- config/manifests/bases/cert-manager-operator.clusterserviceversion.yaml
- bindata/cert-manager-deployment/controller/cert-manager-cluster-view-cr.yaml
🧰 Additional context used
📓 Path-based instructions (1)
**
⚙️ CodeRabbit configuration file
-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.
Files:
bindata/cert-manager-deployment/webhook/cert-manager-webhook-subjectaccessreviews-cr.yamlbundle/metadata/annotations.yamlbindata/cert-manager-deployment/controller/cert-manager-deployment.yamlbindata/cert-manager-deployment/cainjector/cert-manager-cainjector-leaderelection-role.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-challenges-cr.yamlbindata/cert-manager-deployment/cainjector/cert-manager-cainjector-leaderelection-rb.yamlbundle/manifests/operator.openshift.io_certmanagers.yamlbindata/cert-manager-deployment/webhook/cert-manager-webhook-subjectaccessreviews-crb.yamlbindata/cert-manager-deployment/cert-manager/cert-manager-controller-certificatesigningrequests-cr.yamlbundle/manifests/cert-manager.io_issuers.yamlpkg/operator/applyconfigurations/operator/v1alpha1/certmanagerconfig.goconfig/crd/bases/certificates.cert-manager.io-crd.yamlbundle/manifests/acme.cert-manager.io_challenges.yamlMakefilebindata/cert-manager-deployment/cert-manager/cert-manager-controller-certificatesigningrequests-crb.yamlimages/ci/operand.Dockerfilebindata/cert-manager-deployment/controller/cert-manager-svc.yamlbundle/manifests/cert-manager.io_clusterissuers.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-certificates-crb.yamlconfig/crd/bases/clusterissuers.cert-manager.io-crd.yamlpkg/controller/deployment/deployment_overrides_test.gobindata/cert-manager-deployment/cainjector/cert-manager-cainjector-cr.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-ingress-shim-cr.yamlbindata/cert-manager-deployment/webhook/cert-manager-webhook-deployment.yamlconfig/crd/bases/operator.openshift.io_certmanagers.yamlgo.modconfig/crd/bases/orders.acme.cert-manager.io-crd.yamlpkg/operator/assets/bindata.goconfig/crd/bases/issuers.cert-manager.io-crd.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-ingress-shim-crb.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-orders-crb.yamlbundle/manifests/cert-manager.io_certificates.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-issuers-crb.yamlbindata/cert-manager-deployment/controller/cert-manager-sa.yamlpkg/operator/applyconfigurations/operator/v1alpha1/certmanager.gobundle/manifests/operator.openshift.io_istiocsrs.yamlbindata/cert-manager-deployment/cainjector/cert-manager-cainjector-svc.yamlbundle/manifests/cert-manager.io_certificaterequests.yamlconfig/crd/bases/challenges.acme.cert-manager.io-crd.yamlbundle/manifests/acme.cert-manager.io_orders.yaml
🔇 Additional comments (73)
bindata/cert-manager-deployment/cert-manager/cert-manager-controller-certificatesigningrequests-crb.yaml (1)
9-9: Version label correctly updated.The version label update to v1.19.2 aligns with the PR objective to upgrade cert-manager.
bindata/cert-manager-deployment/webhook/cert-manager-webhook-subjectaccessreviews-crb.yaml (1)
9-9: LGTM!The version label update to v1.19.2 is correct and consistent with the cert-manager upgrade objective.
pkg/controller/deployment/deployment_overrides_test.go (1)
35-35: LGTM! Version bump correctly applied.The test expectations have been consistently updated to reflect the cert-manager v1.19.2 upgrade. All occurrences of the acme-http01-solver-image version string are correctly updated across default args and test expectations.
Also applies to: 123-123, 175-175
bundle/manifests/operator.openshift.io_certmanagers.yaml (3)
5-5: LGTM!Controller-gen version bump to v0.19.0 aligns with the upstream cert-manager v1.19.2 update.
63-159: LGTM!The
fileKeyRefaddition and env var name description update align with upstream Kubernetes API changes. The schema is properly structured with required fields (key,path,volumeName), sensible defaults (optional: false), and clear documentation noting the alpha EnvFiles feature gate dependency.
344-440: LGTM!The
fileKeyRefand env var name description changes are consistently applied acrosscontrollerConfigandwebhookConfig, matching thecainjectorConfigsection. Good schema consistency.Also applies to: 939-1035
pkg/operator/applyconfigurations/operator/v1alpha1/certmanager.go (1)
67-67: LGTM! Generated methods follow established patterns.The added marker method
IsApplyConfiguration()and getter methods (GetKind,GetAPIVersion,GetNamespace) are correctly implemented:
IsApplyConfiguration()serves as an interface marker (standard pattern)GetKind()andGetAPIVersion()safely access the value-embeddedTypeMetaApplyConfigurationGetNamespace()properly callsensureObjectMetaApplyConfigurationExists()before accessing the pointer field, consistent with the existingGetName()implementationThese are generated additions from the upstream cert-manager v1.19.2 bump with no concerns.
Also applies to: 243-263
pkg/operator/applyconfigurations/operator/v1alpha1/certmanagerconfig.go (1)
12-12: No action needed — WithIssuerRef is not called anywhere in the codebase.The file is correctly generated code. The IssuerRef field type (
v1.IssuerReference) and the WithIssuerRef method are defined properly in the apply configuration, but the method has no actual callers. No call sites require updates because this method is not used.Likely an incorrect or invalid review comment.
config/crd/bases/operator.openshift.io_certmanagers.yaml (3)
6-6: LGTM: Controller-gen version bump.The controller-gen version update from v0.15.0 to v0.19.0 aligns with the upstream cert-manager v1.19.2 upgrade.
708-712: Unable to verify AI summary claims due to lack of git history in the repository. The current protocol field definition (lines 708-712) contains a description stating "If not specified, this field defaults to TCP" but no explicitdefault: TCPproperty is present. Without access to previous commits, the claim that a default value was removed cannot be confirmed. If this change is significant for users upgrading NetworkPolicy resources, it should be documented in release notes regardless of whether an explicit schema default was removed.
63-66: No action required - this uses standard Kubernetes EnvVar validation.The
overrideEnvfield uses Kubernetes' standardcorev1.EnvVartype, and the CRD description is auto-generated from that standard type. The description "May consist of any printable ASCII characters except '='" reflects the standard Kubernetes behavior for environment variable names, not a custom relaxation. The codebase does not implement custom validation; it relies entirely on the upstream Kubernetes API types in v0.34.1. No compatibility concerns exist.bindata/cert-manager-deployment/cert-manager/cert-manager-controller-certificatesigningrequests-cr.yaml (1)
9-9: LGTM!Version label correctly updated to v1.19.2, consistent with the PR's upstream bump objective.
bindata/cert-manager-deployment/webhook/cert-manager-webhook-subjectaccessreviews-cr.yaml (1)
9-9: LGTM!Version label correctly updated to v1.19.2, aligning with the cert-manager upgrade.
bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-leaderelection-role.yaml (1)
9-9: LGTM!Version label correctly updated to v1.19.2 for the cainjector leaderelection Role.
bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-cr.yaml (1)
9-9: LGTM!Version label correctly updated to v1.19.2 for the cainjector ClusterRole.
bindata/cert-manager-deployment/controller/cert-manager-controller-challenges-cr.yaml (1)
9-9: LGTM!Version label correctly updated to v1.19.2 for the controller challenges ClusterRole.
bindata/cert-manager-deployment/controller/cert-manager-controller-orders-crb.yaml (1)
9-9: LGTM!Version label correctly updated to v1.19.2 for the controller orders ClusterRoleBinding.
bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-svc.yaml (1)
9-9: LGTM!Version label correctly updated to v1.19.2 for the cainjector Service, completing the consistent version bump across all reviewed manifests.
images/ci/operand.Dockerfile (1)
1-3: Base image upgrade is properly applied across configuration files.The base builder image has been updated to golang-1.25-openshift-4.21 and is consistently referenced in operand.Dockerfile, images/ci/Dockerfile, and the Makefile. The release branch is correctly set to v1.19.2. However, image availability cannot be verified in this environment and requires manual confirmation that the base image exists in the registry.
bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-leaderelection-rb.yaml (1)
9-9: LGTM! Version label correctly updated.The version label update from v1.18.3 to v1.19.2 aligns with the upstream cert-manager upgrade objective.
bindata/cert-manager-deployment/controller/cert-manager-controller-certificates-crb.yaml (1)
9-9: LGTM! Version label correctly updated.The version label update to v1.19.2 is consistent with the cert-manager upgrade.
bindata/cert-manager-deployment/controller/cert-manager-sa.yaml (1)
10-10: LGTM! Version label correctly updated.The ServiceAccount version label update aligns with the v1.19.2 upgrade.
bindata/cert-manager-deployment/controller/cert-manager-svc.yaml (1)
9-9: LGTM! Version label correctly updated.The Service version label update is consistent with the cert-manager v1.19.2 upgrade.
bindata/cert-manager-deployment/controller/cert-manager-controller-ingress-shim-cr.yaml (1)
9-9: LGTM! Version label correctly updated.The ClusterRole version label update aligns with the v1.19.2 upgrade.
bindata/cert-manager-deployment/webhook/cert-manager-webhook-deployment.yaml (1)
9-9: LGTM! Version labels and image tag correctly updated.The webhook deployment version labels and container image tag are consistently updated to v1.19.2, aligning with the cert-manager upgrade.
Also applies to: 30-30, 46-46
bundle/metadata/annotations.yaml (1)
7-7: LGTM! Bundle channel correctly updated.The channel update from stable-v1.18 to stable-v1.19 correctly reflects the version series upgrade to v1.19.x.
bindata/cert-manager-deployment/controller/cert-manager-controller-ingress-shim-crb.yaml (1)
9-9: LGTM! Version label correctly updated.The ClusterRoleBinding version label update to v1.19.2 is consistent with the cert-manager upgrade.
bindata/cert-manager-deployment/controller/cert-manager-controller-issuers-crb.yaml (1)
9-9: LGTM!Version label correctly updated to v1.19.2, consistent with the upstream cert-manager version bump.
bindata/cert-manager-deployment/controller/cert-manager-deployment.yaml (1)
9-9: LGTM!All version labels and image tags are consistently updated to v1.19.2:
- Metadata and pod template labels (lines 9, 30)
- ACME HTTP01 solver image argument (line 37)
- Controller container image (line 47)
Also applies to: 30-30, 37-37, 47-47
bundle/manifests/cert-manager.io_certificates.yaml (3)
10-13: LGTM!Added
crdscomponent label and version bump to v1.19.2 aligns with the upstream cert-manager release.
104-104: LGTM!The
x-kubernetes-list-type: atomicannotations are correctly applied to list fields. This ensures proper Server-Side Apply (SSA) semantics where these lists are replaced entirely rather than merged, which is appropriate for certificate configuration arrays likeadditionalOutputFormats,dnsNames,emailAddresses, andipAddresses.Also applies to: 120-120, 136-136, 149-149
170-181: LGTM!The
issuerReffield descriptions now explicitly document the default values forgroup(cert-manager.io) andkind(Issuer). This improves API discoverability without changing behavior.Makefile (3)
6-7: LGTM!Version variables correctly updated:
BUNDLE_VERSIONto 1.19.0 (operator bundle version)CERT_MANAGER_VERSIONto v1.19.2 (upstream cert-manager operand version)The distinction between bundle version (1.19.0) and operand version (v1.19.2) is appropriate for operator lifecycle management.
15-15: LGTM!Channel configuration properly updated for v1.19 release:
CHANNELSupdated to includestable-v1.19DEFAULT_CHANNELset tostable-v1for OLM default channel handlingBUNDLE_METADATA_OPTScorrectly includes both channel flagsAlso applies to: 25-29
89-89: LGTM!Container image updated to
rhel-9-golang-1.25-openshift-4.21, aligning with the Go 1.25 toolchain requirement for cert-manager v1.19.2 and targeting OpenShift 4.21.config/crd/bases/orders.acme.cert-manager.io-crd.yaml (3)
12-12: LGTM!Version label correctly updated to v1.19.2, consistent with other CRD manifests.
80-80: LGTM!
x-kubernetes-list-type: atomiccorrectly applied to ACME Order arrays (dnsNames,ipAddresses,challenges,authorizations). These fields should be replaced atomically during updates rather than merged.Also applies to: 94-94, 184-184, 222-222
104-115: LGTM!The
issuerReffield descriptions are updated consistently with other CRDs, documenting default values forgroupandkindfields.bundle/manifests/cert-manager.io_issuers.yaml (5)
13-13: Version label and printer columns look consistent with the v1.19.2 bump
app.kubernetes.io/versionand the Ready/Status jsonPath expressions are updated in a purely cosmetic, upstream-aligned way; no behavioral change or risk here.Also applies to: 29-32
543-550: RFC2136protocolenum is backward compatible and well-scopedAdding the optional
protocolfield with enum{TCP, UDP}under the RFC2136 DNS01 solver is schema-correct and keeps existing manifests valid since the field isn’t required; the default behavior can continue to be implied by the controller.
644-644: Newx-kubernetes-*list/map markers align with structural schema best practicesMarking these arrays (audiences, parentRefs, imagePullSecrets, supplementalGroups, sysctls, tolerations, dnsNames/dnsZones, CA/selfSigned/Vault lists) as
atomicormapwithx-kubernetes-list-map-keysmatches Kubernetes structural schema guidance and should improve merge behavior without changing semantics.Also applies to: 923-924, 1949-1951, 2117-2117, 2140-2140, 2185-2185, 3276-3278, 3444-3444, 3467-3467, 3512-3512, 3542-3542, 3557-3557, 3568-3568, 3587-3587, 3596-3596, 3607-3607, 3629-3629, 3758-3758
1566-1568: Pod anti-affinity weight wording change is documentation-onlyThe updated description about “subtracting weight” for preferred anti-affinity terms is confined to comments, keeps the schema unchanged, and is consistent across both podAntiAffinity blocks; nothing to adjust from an operator perspective.
Also applies to: 2893-2895
1963-1996: ACME HTTP01 solverresourcesoverrides are modeled correctlyThe new
resourcesobjects for HTTP01 solver pod templates use the standard resource.Quantity pattern andx-kubernetes-int-or-stringsemantics for limits/requests, are optional, and don’t introduce new required fields—this is a safe, backwards-compatible enhancement.Also applies to: 3290-3323
bundle/manifests/cert-manager.io_certificaterequests.yaml (4)
10-13: LGTM! Version bump and metadata update are correct.The version update to v1.19.2 and the addition of the
app.kubernetes.io/component: crdslabel align with upstream cert-manager v1.19.2 and follow standard Kubernetes labeling conventions.
30-45: LGTM! JSONPath formatting improvements are consistent.The spacing around the equality operator in JSONPath expressions improves readability and follows standard formatting conventions. These changes are valid and consistent across all printer columns.
136-147: LGTM! Improved issuerRef field documentation.The updated descriptions for
issuerReffields clarify the default values (group defaults to 'cert-manager.io', kind defaults to 'Issuer'), which improves API documentation and user understanding.
236-236: LGTM! Appropriate list type annotation.The
x-kubernetes-list-type: atomicannotation is correct for the usages field, which contains key usage enums. This ensures proper merge behavior where the entire list is treated as a single atomic unit.bundle/manifests/acme.cert-manager.io_orders.yaml (4)
13-13: LGTM! Version bump is consistent.The version update to v1.19.2 matches the PR objective and is consistent with other CRD manifests in this upgrade.
84-98: LGTM! Appropriate list type annotations for spec fields.The
x-kubernetes-list-type: atomicannotations fordnsNamesandipAddressesare correct. These fields should be treated as atomic units during updates, which is appropriate for DNS name and IP address lists.
108-119: LGTM! Consistent issuerRef documentation improvements.The issuerRef field descriptions match the improvements in the certificaterequests CRD, providing clear default values and improving API documentation consistency across all cert-manager CRDs.
188-228: LGTM! Appropriate list type annotations for status fields.The
x-kubernetes-list-type: atomicannotations forauthorizationsand nestedchallengesarrays are correct. These status fields contain ACME server responses and should be treated atomically, which aligns with their usage pattern where the controller replaces the entire list during reconciliation.config/crd/bases/issuers.cert-manager.io-crd.yaml (3)
12-12: Version label and printer column JSONPath updates are fineLabel bump to
v1.19.2and JSONPath spacing changes are metadata-only and keep behavior unchanged; no issues.Also applies to: 28-31
526-531: RFC2136protocolfield addition looks correctOptional
protocolenum (TCP/UDP) underrfc2136.nameserveris well-scoped, non-breaking (not required), and matches the described behavior; schema is consistent.
623-623: CRD list semantics and solver pod resource overrides align with Kubernetes schema best practicesThe added
x-kubernetes-list-type/x-kubernetes-list-map-keysmarkers for lists (audiences, parentRefs, imagePullSecrets, tolerations, string arrays, etc.) plus the newresourcesoverrides for HTTP01 solver pods and related issuer fields improve structural schema fidelity and patch/apply behavior, and appear consistent and non-breaking across the CRD.Also applies to: 900-900, 1822-1869, 1985-1985, 2005-2005, 2049-2049, 3033-3035, 3047-3080, 3196-3196, 3216-3216, 3260-3260, 3290-3290, 3305-3305, 3316-3316, 3335-3335, 3344-3344, 3355-3355, 3377-3377, 3505-3505
bundle/manifests/acme.cert-manager.io_challenges.yaml (1)
10-13: CRD schema, list markers, and resource fields look consistent with upstream and safeThe added labels, issuerRef description tweaks, new RFC2136
protocolfield, list/map metadata (x-kubernetes-*), and HTTP01 solver pod templateresourcesblocks are structurally sound and improve clarity and merge semantics without changing controller behavior. No issues from an operator/CRD perspective.Also applies to: 81-105, 415-468, 647-2049, 2137-3357, 3367-3395
go.mod (1)
3-352: Toolchain and dependency bumps look coherent; rely on CI/e2e to catch regressionsThe Go version bump and broad upgrade of cert-manager, Kubernetes, controller-runtime/tools, AWS SDK, OTel, and related libraries, plus the
cert-manager→jetstack-cert-manager v1.19.2replace, form a consistent stack and align with the stated upgrade to cert-manager v1.19.2. I don't see any obviously mismatched module versions or suspect replaces here; the graph looks internally consistent for a rebase of this scope.Given the size of the change surface, please rely on CI and targeted e2e runs (especially AWS, Gateway API, and CRD-heavy paths) to validate runtime compatibility and uncover any subtle behavior changes introduced by upstream dependencies.
Also applies to: 354-355
bundle/manifests/cert-manager.io_clusterissuers.yaml (7)
8-13: Metadata labels and version bump look consistent
app.kubernetes.io/component: crdsandapp.kubernetes.io/version: v1.19.2align with this being the CRD bundle for the v1.19.2 cert-manager operand; no concerns here. Just keep this version label consistent with other cert-manager CRDs/bundle manifests in the repo.
28-35: Ready/Status printer columns JSONPath remains correctThe
additionalPrinterColumnsJSONPath expressions forReadyandStatusstill correctly select the Ready condition’sstatusandmessage. The minor formatting change is harmless and keeps kubectl output stable.
537-551: RFC2136 DNS01protocolfield is well-scopedThe new
spec.acme.solvers[].dns01.rfc2136.protocolfield is constrained toTCP/UDPand clearly documentsUDPas the default when unset. This matches the expected RFC2136 usage pattern and doesn’t introduce schema or validation risks.
645-647: x-kubernetes list metadata additions improve SSA/merge semanticsThe added
x-kubernetes-list-type: atomic(here forserviceAccountRef.audiences) and similarx-kubernetes-list-type/x-kubernetes-list-map-keysannotations throughout the schema bring these CRD fields in line with core Kubernetes API conventions, improving server-side apply and patch behavior without changing stored data.
1932-1952: HTTP01 solver podTemplate: imagePullSecrets + resources extensions look correct
- Switching
imagePullSecretsto amaplist keyed byname(withx-kubernetes-list-map-keys/x-kubernetes-list-type: map) matches core PodSpec behavior and gives better patch semantics.- The new
podTemplate.spec.resourcesblock for HTTP01 solver pods uses the standardresource.Quantityschema (x-kubernetes-int-or-stringwith the usual quantity regex) and cleanly documents interaction with global controller flags.These changes are consistent with upstream cert-manager and should be safe for existing manifests.
Also applies to: 1964-1997, 3259-3279, 3291-3324
2106-2142: PodSecurityContext list fields marked atomic are aligned with core APIMarking
supplementalGroupsandsysctlsasx-kubernetes-list-type: atomicfor the solver podsecurityContextmatches how these lists behave in core PodSecurityContext, preventing surprising merge behavior. No issues from a validation or security perspective.Also applies to: 3433-3468
3531-3570: Selector and issuer list fields now explicitly atomic—matches intentThe additions of
x-kubernetes-list-type: atomicfor:
selector.dnsNamesandselector.dnsZones,- the top-level
acme.solverslist,- CA/self-signed
crlDistributionPoints/issuingCertificateURLs/ocspServers,- Vault
serviceAccountRef.audiences,all reflect these as flat lists of scalar values where full replacement on patch is expected. That aligns with how these fields are typically used and shouldn’t affect existing consumers.
Also applies to: 3580-3631, 3752-3760
config/crd/bases/certificates.cert-manager.io-crd.yaml (1)
9-12: CRD label, printer column, and list-type updates align with upstream cert-manager schemaThe label/version bump, jsonPath spacing tweak, issuerRef description clarification, and the added
x-kubernetes-list-type: atomicannotations on the various arrays all look consistent with the v1.19.2 cert-manager CRDs and should not change behavior beyond improving structural schema semantics for SSA and validation.Please just confirm this CRD was regenerated from upstream (e.g., via the usual
controller-gen/makeflow) rather than hand-edited, so it stays in lockstep with the source API.Also applies to: 29-40, 100-133, 141-146, 156-180, 331-387, 389-411, 571-595, 610-623, 624-688
pkg/operator/assets/bindata.go (1)
34-35: Generated bindata changes and new cert-manager-tokenrequest RB asset are internally consistent
- All the
app.kubernetes.io/version: v1.19.2label bumps and the controller/cainjector/webhook image updates toquay.io/jetstack/*:v1.19.2are coherent across assets.- The new
cert-manager-tokenrequest-rb.yamlRoleBinding asset, its byte var, helper functions,_bindatamap entry, and_bintreenode all use the same path (cert-manager-deployment/controller/cert-manager-tokenrequest-rb.yaml) and correctly bind thecert-manager-tokenrequestRole to thecert-managerServiceAccount in thecert-managernamespace.- I don’t see any leftover references to the old tokenrequest RB asset name in this file.
Since this file is generated by go-bindata, please confirm it was fully regenerated from the updated YAML sources (rather than edited by hand) so future updates don’t accidentally overwrite these changes.
Also applies to: 119-128, 203-212, 238-268, 280-281, 467-476, 504-513, 539-548, 656-665, 693-702, 778-787, 813-822, 969-978, 1031-1040, 1066-1075, 1151-1160, 1186-1195, 1283-1292, 1365-1374, 1400-1430, 1446-1447, 1497-1506, 1556-1565, 1592-1601, 1637-1647, 1666-1675, 1705-1739, 1741-1750, 1938-1947, 1974-1983, 2020-2031, 2071-2081, 2100-2109, 2134-2143, 2169-2178, 2212-2223, 3158-3159, 3235-3275
bundle/manifests/operator.openshift.io_istiocsrs.yaml (1)
5-5: IstioCSR CRD description/controller-gen updates are doc-only and safeThe controller-gen version annotation bump, the refined pod (anti)affinity weighting text, the DynamicResourceAllocation note on
resources.claims, and the clarifiedcertManager.issuerRefgroup/kind/name descriptions are all documentation/metadata-only; schema, validation rules, and defaults remain unchanged, so existing IstioCSR resources won’t be affected.Please confirm this CRD was regenerated with the updated controller-gen / API definitions rather than edited manually, to keep it aligned with upstream.
Also applies to: 294-305, 652-662, 1015-1027, 1237-1243
config/crd/bases/challenges.acme.cert-manager.io-crd.yaml (6)
9-12: Metadata labels/version bump LGTM
app.kubernetes.io/component: crdsandapp.kubernetes.io/version: v1.19.2are consistent with the operand upgrade and CRD role; nothing else needed here.
84-96: issuerRef description updates match Issuer defaultsClarified descriptions for
issuerRef.group,issuerRef.kind, andissuerRef.nameaccurately describe the issuer context and documented defaults, without changing the schema itself.
414-419: New RFC2136protocolfield is a safe extensionAdding optional
protocolwith enumTCP/UDP(default via controller behavior) keepsnameserveras the only required property, so existing RFC2136 configurations remain valid while allowing more explicit transport selection.
1710-1712: PodTemplateimagePullSecrets+resourcesschema look correctUsing
x-kubernetes-list-type: mapwithx-kubernetes-list-map-keys: [name]forimagePullSecretsand introducing aresourcesobject shaped like coreResourceRequirementsare both consistent with Kubernetes API patterns and provide predictable merge behavior for solver pods.Also applies to: 1724-1757, 2921-2923, 2935-2968
511-511:x-kubernetes-list-typeannotations are appropriateMarking these arrays (audiences, parentRefs, supplementalGroups, sysctls, tolerations, and selector DNS lists) as
atomicor map-based provides explicit structural metadata and aligns with expected server-side apply/patch semantics without altering existing valid objects.Also applies to: 789-789, 1873-1873, 1893-1893, 1937-1937, 3084-3084, 3104-3104, 3148-3148, 3178-3178, 3193-3193
1360-1362: PodAntiAffinity weight description change is documentation-onlyThe updated explanation about subtracting
weightin preferred anti-affinity terms corrects the textual behavior description while leaving the schema unchanged, so there’s no impact on validation or stored CRs.Also applies to: 2571-2573
config/crd/bases/clusterissuers.cert-manager.io-crd.yaml (1)
9-12: CRD schema bump (labels, RFC2136 protocol, solver resources, list/map markers) looks consistent with upstream
- Label and
app.kubernetes.io/versionchanges align with the v1.19.2 bump.- New
spec.acme.dns01.rfc2136.nameserver.protocolstring enum (TCP/UDP) is additive and keeps existing CRs valid; description matches expected behavior.- Added
podTemplate.spec.resourcesblocks for HTTP01 solvers (gateway and ingress) use the standard resource quantity schema and are also additive.- The various new
x-kubernetes-list-type/x-kubernetes-list-map-keysannotations on lists (imagePullSecrets, audiences, dnsNames/dnsZones, CRL/OCSP lists, etc.) follow Kubernetes structural schema and SSA best practices and should only improve patch/merge semantics rather than change meaning.From what’s shown here, I don’t see any breaking or security-impacting changes; keeping this file generated and in lockstep with the upstream cert-manager v1.19.2 types is the right approach. Please just ensure all other CRD copies/bundles (e.g., under
bundle/manifests) were regenerated from the same upstream revision and that CI/CRD validation passes with these enums and annotations.Also applies to: 28-31, 528-532, 1823-1825, 1838-1870, 3035-3037, 3049-3081, 3291-3292, 3306-3307, 3334-3337, 3338-3345, 3347-3356, 3376-3378, 3504-3507
| app.kubernetes.io/version: v1.18.3 | ||
| name: cert-manager-cert-manager-tokenrequest | ||
| app.kubernetes.io/version: v1.19.2 | ||
| name: cert-manager-tokenrequest |
There was a problem hiding this comment.
Not directly related to the changes. But how do we manage the renamed resource in upgraded clusters.
There was a problem hiding this comment.
@PillaiManish Could you please create a follow-up PR to cleanup the resource with legacy name. Thank you!
There was a problem hiding this comment.
@bharath-b-rh I assume we even don't need to handle the legacy resource cleanup. I tested it when making this change through upstream charts: cert-manager/cert-manager#7761, see "Verification".
But it's good to double-check. @PillaiManish could you please examine it (install 1.18.0 -> upgrade to 1.19.0) to see if cert-manager-cert-manager-tokenrequest could be pruned automatically?
openshift-ci
bot
added
lgtm
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting
📒 Files selected for processing (2)
bundle/manifests/cert-manager-operator.clusterserviceversion.yaml(5 hunks)config/manifests/bases/cert-manager-operator.clusterserviceversion.yaml(4 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
**
⚙️ CodeRabbit configuration file
-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.
Files:
config/manifests/bases/cert-manager-operator.clusterserviceversion.yamlbundle/manifests/cert-manager-operator.clusterserviceversion.yaml
🔇 Additional comments (8)
bundle/manifests/cert-manager-operator.clusterserviceversion.yaml (6)
253-253: LGTM!The skipRange is correctly set to allow upgrades from 1.18.x versions to this 1.19.0 release.
274-274: LGTM!Metadata name correctly updated to reflect version 1.19.0.
701-715: LGTM!All environment variables are consistently updated:
- cert-manager components to v1.19.2
- Operator version to 1.19.0
- IstioCSR appropriately remains at v0.14.2
813-813: LGTM!The minKubeVersion has been appropriately updated to 1.31.0 as per previous review feedback.
817-826: LGTM!Related images are consistently updated to v1.19.2 for all cert-manager components and correctly aligned with the environment variables defined earlier in the manifest.
827-828: LGTM!The version field (1.19.0) and replaces field (cert-manager-operator.v1.18.0) correctly define the upgrade path from the previous release.
config/manifests/bases/cert-manager-operator.clusterserviceversion.yaml (2)
21-21: LGTM!The OLM version metadata updates are internally consistent and follow the correct upgrade pattern from v1.18.0 to v1.19.0.
Also applies to: 41-41, 152-153
149-149: The minKubeVersion change from 1.27.0 to 1.31.0 is correct. cert-manager v1.19.2 requires Kubernetes v1.31 or newer (supported range: v1.31 → v1.34), and this aligns with OpenShift 4.21 (Kubernetes 1.34) and 4.22 (Kubernetes 1.35) as mentioned in the PR comments.
bundle/manifests/cert-manager-operator.clusterserviceversion.yaml
Outdated
Show resolved
Hide resolved
config/manifests/bases/cert-manager-operator.clusterserviceversion.yaml
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
It would be great if we could add one more line to each commit message explaining the context for the change, just for future reference. Especially for
- abb105b (The reason you've already explained in the PR description, it's good to include same as part of the commit)
- b2a5388 (It would be clearer to mention exactly which packages are being bumped and which
latestis being referred to, but I think it should be a specific tag not the driftinglatest?) - 179c4a6 (The context would be lost in a review comment)
| version: v1alpha1 | ||
| description: | | ||
| The cert-manager Operator for Red Hat OpenShift provides seamless support for [cert-manager v1.18.3](https://github.com/cert-manager/cert-manager/tree/v1.18.3), which automates certificate management. | ||
| The cert-manager Operator for Red Hat OpenShift provides seamless support for [cert-manager v1.19.2](https://github.com/cert-manager/cert-manager/tree/v1.18.3), which automates certificate management. |
There was a problem hiding this comment.
| The cert-manager Operator for Red Hat OpenShift provides seamless support for [cert-manager v1.19.2](https://github.com/cert-manager/cert-manager/tree/v1.18.3), which automates certificate management. | |
| The cert-manager Operator for Red Hat OpenShift provides seamless support for [cert-manager v1.19.2](https://github.com/cert-manager/cert-manager/tree/v1.19.2), which automates certificate management. |
There was a problem hiding this comment.
Actionable comments posted: 1
Fix all issues with AI Agents 🤖
In @go.mod:
- Line 3: Update the Go version in go.mod from "go 1.25.0" to "go 1.25.5" to
apply the security and bugfix patch; open go.mod, locate the existing "go
1.25.0" stanza and change it to "go 1.25.5", then run `go mod tidy` and re-run
CI/build to ensure the toolchain and module graph pick up the patch.
♻️ Duplicate comments (1)
config/manifests/bases/cert-manager-operator.clusterserviceversion.yaml (1)
149-149: Verify minKubeVersion 1.31.0 requirement (same as bundle manifest).This base configuration mirrors the minKubeVersion bump to 1.31.0 seen in the bundle manifest. Ensure the same verification steps for compatibility with target OpenShift versions (4.18-4.21) are applied.
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (12)
.ci-operator.yamlDockerfileMakefilebundle/manifests/cert-manager-operator.clusterserviceversion.yamlconfig/manager/manager.yamlconfig/manifests/bases/cert-manager-operator.clusterserviceversion.yamlgo.modimages/ci/Dockerfileimages/ci/operand.Dockerfilepkg/controller/deployment/cert_manager_controller_deployment.gopkg/controller/deployment/deployment_overrides_test.gopkg/controller/istiocsr/deployments_test.go
🚧 Files skipped from review as they are similar to previous changes (6)
- .ci-operator.yaml
- Dockerfile
- pkg/controller/deployment/deployment_overrides_test.go
- images/ci/operand.Dockerfile
- pkg/controller/deployment/cert_manager_controller_deployment.go
- config/manager/manager.yaml
🧰 Additional context used
📓 Path-based instructions (1)
**
⚙️ CodeRabbit configuration file
-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.
Files:
images/ci/Dockerfilebundle/manifests/cert-manager-operator.clusterserviceversion.yamlgo.modconfig/manifests/bases/cert-manager-operator.clusterserviceversion.yamlMakefilepkg/controller/istiocsr/deployments_test.go
🔇 Additional comments (14)
pkg/controller/istiocsr/deployments_test.go (1)
788-788: LGTM! Test expectation correctly updated for dependency changes.The error message expectation now includes quotes around the invalid resource type value
"test", which aligns with updated error formatting from the dependency bumps (cert-manager v1.19.2, Go 1.25). The test logic remains sound.images/ci/Dockerfile (1)
1-1: LGTM!The base builder image version bump to Go 1.25 and OpenShift 4.21 aligns correctly with the PR objectives and the go.mod toolchain update.
go.mod (2)
354-354: LGTM!The cert-manager replacement directive correctly points to the OpenShift downstream fork at v1.19.2, which aligns with the PR objectives and version bumps throughout the codebase.
6-46: > Likely an incorrect or invalid review comment.Makefile (3)
6-15: LGTM!The version variable updates for BUNDLE_VERSION (1.19.0), CERT_MANAGER_VERSION (v1.19.2), and CHANNELS (stable-v1.19) are consistent with the PR objectives for the v1.19.0 release.
25-29: LGTM!The addition of DEFAULT_CHANNEL (stable-v1) and its integration into BUNDLE_METADATA_OPTS follows best practices for OLM bundle configuration and allows explicit specification of the default channel.
89-89: LGTM!The CONTAINER_IMAGE_NAME update to golang-1.25-openshift-4.21 is consistent with the Dockerfile changes and broader version bump strategy.
bundle/manifests/cert-manager-operator.clusterserviceversion.yaml (5)
253-253: LGTM!The OLM metadata updates (skipRange, name, replaces, version) are correctly configured for the v1.19.0 release and maintain proper version succession from v1.18.0.
Also applies to: 274-274, 827-828
348-348: The description URL has been correctly updated.The GitHub URL now properly references cert-manager v1.19.2, resolving the previously flagged inconsistency.
701-715: LGTM!The image references and version environment variables are correctly updated to cert-manager v1.19.2 and operator v1.19.0, maintaining consistency across the deployment specification.
817-826: LGTM!The relatedImages entries correctly reference cert-manager v1.19.2 images, maintaining consistency with the version bump. The istio-csr version remains at v0.14.2 as expected.
813-813: minKubeVersion 1.31.0 requirement is correct and verified.The minimum Kubernetes version requirement aligns with cert-manager v1.19.2, which requires Kubernetes 1.31 minimum support. This is compatible with the target OpenShift versions where 4.18 (the earliest supported version) uses Kubernetes 1.31, and later versions (4.19-4.21) use 1.32-1.34. No action required.
config/manifests/bases/cert-manager-operator.clusterserviceversion.yaml (2)
21-21: LGTM!The version metadata (skipRange, name, replaces, version) is correctly configured for v1.19.0 and matches the bundle manifest, maintaining consistency across base and generated configurations.
Also applies to: 41-41, 152-153
115-115: The description URL has been correctly updated.The GitHub URL now properly references cert-manager v1.19.2, addressing the previously flagged URL inconsistency.
|
/label qe-approved |
openshift-ci
bot
added
the
qe-approved
|
@PillaiManish: This pull request references CM-825 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@PillaiManish Thanks for your work. For commit updates libraries to latest version, what I was thinking is that we should bump each pkg with a specific version tag rather than the vague (omitted) |
|
Nit: ac7ac60 should also mention 4.22 as per the lifecycle page: https://docs.google.com/document/d/1K42PhOp_8_izjggMo62J1-5ALkRvYwJ9ned_evl8ins/edit?tab=t.0#bookmark=kix.dk6mmf7269fh |
- go get github.com/openshift/api@release-4.21 - go get github.com/openshift/client-go@release-4.21 - go get github.com/openshift/library-go@release-4.21 - go get k8s.io/kubernetes@v1.34.1 # to align with k8s.io/*'s v0.34.1 - go mod tidy && go mod vendor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI Agents
In @go.mod:
- Line 3: Update the Go version declaration in go.mod from "go 1.25.0" to "go
1.25.5"; after changing the "go" directive, run your usual module/CI
verification (e.g., go mod tidy and your build/test pipeline) to ensure the
project still builds with Go 1.25.5.
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (5)
bundle/manifests/cert-manager-operator.clusterserviceversion.yamlconfig/manifests/bases/cert-manager-operator.clusterserviceversion.yamlgo.modpkg/controller/deployment/cert_manager_controller_deployment.gopkg/controller/istiocsr/deployments_test.go
🚧 Files skipped from review as they are similar to previous changes (3)
- pkg/controller/istiocsr/deployments_test.go
- pkg/controller/deployment/cert_manager_controller_deployment.go
- config/manifests/bases/cert-manager-operator.clusterserviceversion.yaml
🧰 Additional context used
📓 Path-based instructions (1)
**
⚙️ CodeRabbit configuration file
-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.
Files:
go.modbundle/manifests/cert-manager-operator.clusterserviceversion.yaml
🔇 Additional comments (2)
go.mod (1)
10-46: Dependency updates look consistent.The cert-manager v1.19.2 upgrade and associated dependency bumps (Kubernetes v0.34.1, controller-runtime v0.22.3, OpenShift components) align with the PR objectives. Version consistency is maintained throughout the dependency graph.
bundle/manifests/cert-manager-operator.clusterserviceversion.yaml (1)
253-253: Version updates are consistent and well-coordinated.The CSV updates correctly reflect the cert-manager v1.19.2 and operator v1.19.0 bump:
olm.skipRangeproperly constrains upgrade path- All related images consistently reference v1.19.2
- Version metadata fields (name, replaces, version) follow semantic versioning
minKubeVersionbump to 1.31.0 aligns with the stated support for OpenShift 4.18-4.21Also applies to: 274-274, 348-348, 701-715, 813-813, 817-828
| module github.com/openshift/cert-manager-operator | ||
|
|
||
| go 1.24.4 | ||
| go 1.25.0 |
There was a problem hiding this comment.
Upgrade Go to 1.25.5 for security fixes.
As previously noted, Go 1.25.5 includes security fixes to crypto/x509 and bug fixes in mime and os packages. Since patch updates within the 1.25.x line contain no breaking changes, updating from 1.25.0 to 1.25.5 is a drop-in replacement.
🤖 Prompt for AI Agents
In @go.mod around line 3, Update the Go version declaration in go.mod from "go
1.25.0" to "go 1.25.5"; after changing the "go" directive, run your usual
module/CI verification (e.g., go mod tidy and your build/test pipeline) to
ensure the project still builds with Go 1.25.5.
- v1.19 will be supported from 4.18-4.22
|
/test e2e-operator-aws-proxy e2e-operator-aws-sts e2e-operator-gcp-ovn e2e-operator-gcp-workload-identity |
|
/retest |
1 similar comment
|
/retest |
|
/verified by CIs Regular e2e-operator + newly added jobs are passing |
openshift-ci-robot
added
the
verified
|
@lunarwhite: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/cc @bharath-b-rh for final review |
|
@lunarwhite: GitHub didn't allow me to request PR reviews from the following users: for, final, review. Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@PillaiManish: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/lgtm adding other required labels, the relevant doc update will be part of RN. |
openshift-ci
bot
added
the
px-approved
|
@bharath-b-rh: The label(s) DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/label docs-approved |
openshift-ci
bot
added
docs-approved
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bharath-b-rh, PillaiManish The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
5 participants
Rebase downstream cert-manager-operator for v1.19.0 with upstream cert-manager v1.19.2.
Prerequisite: Downstream v1.19.2 tag is pushed and synced https://github.com/openshift/jetstack-cert-manager/tags
Remove
Since
github.com/openshift/kubernetes-sigs-controller-toolsis not being maintained in the downstream.All the following below steps were done with the help of automation script: #309