WIP: Rebase 1.37

[jacobsee]

No description provided.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci]

Hello @jacobsee! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

---

📝 Walkthrough

Walkthrough

Updated application and tooling Go dependencies, including the controller-tools replacement target. Revised CRD schema descriptions for volume data sources and ConfigMap binary keys. Added file-specific error handling to Swagger documentation parsing.

Suggested reviewers: joelspeed, everettraven

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 inconclusive)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❌ Error	Vendored gRPC updates add V(2) logs of raw RLS JSON and xDS-generated configs/resource names, which may expose internal hostnames or customer configuration.	Redact hostnames and sensitive configuration fields, or log only fixed status metadata instead of raw service-config and resource values.
Description check	❓ Inconclusive	No pull request description was provided, so the changes are not documented in the description.	Add a concise description that summarizes the dependency updates, CRD documentation changes, and code-generation error handling.

✅ Passed checks (13 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title identifies this as a rebase to 1.37, which is related to the dependency, schema, and tooling updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes no test files and adds no Ginkgo title declarations; changes are limited to dependencies, generated artifacts, CRD descriptions, and swagger documentation error handling.
Test Structure And Quality	✅ Passed	The pull request changes no *_test.go files or Ginkgo test code; all eight changed paths are generated OpenAPI or CRD manifests, so this check is not applicable.
Microshift Test Compatibility	✅ Passed	The PR adds no Ginkgo or e2e tests. Changed non-vendored Go files are generated OpenAPI code and codegen logic, so MicroShift test compatibility is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR adds no *_test.go files or Ginkgo declarations; its changes are dependencies, generated artifacts, CRDs, vendored code, and codegen logic.
Topology-Aware Scheduling Compatibility	✅ Passed	The effective diff contains dependencies, vendored/generated APIs, CRD descriptions, and generator error handling; it adds no deployment manifests, controllers, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	PR changes no OTE entrypoint or test suite; the only repository-owned Go change is swagger documentation error handling, and suite setup uses GinkgoWriter.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR adds no Ginkgo e2e tests; its changes are dependency, generated artifact, vendored code, and codegen updates, so this IPv6/disconnected-network check is not applicable.
No-Weak-Crypto	✅ Passed	The PR adds no weak-crypto calls, custom crypto, or secret comparisons; MD5/SHA1/3DES matches are vendored telemetry metadata or standard-library symbol metadata.
Container-Privileges	✅ Passed	Changed CRD and generated OpenAPI diffs add no privileged:true, hostPID, hostIPC, SYS_ADMIN, allowPrivilegeEscalation:true, or root settings; hostNetwork appears only as API schema documentation.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

Error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented
The command is terminated due to an error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign deads2k for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[qodo-for-rh-openshift]

PR Summary by Qodo

Bump Kubernetes deps to v0.37.0-beta.0 and re-vendor

⚙️ Configuration changes ✨ Enhancement 🕐 40+ Minutes

AI Description

• Update k8s.io/* modules (and related Go deps) to v0.37.0-beta.0.
• Re-vendor root and tools modules to match the new dependency graph.
• Regenerate CRD manifests and fix swaggerdocs codegen for new API errors.

Diagram

graph TD
  A["K8s deps v0.37"] --> B["go.mod files"] --> C["go mod vendor"] --> D["vendored deps"]
  B --> E["swaggerdocs gen"] --> F["CRD YAML"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Target stable v0.37.0 instead of beta

• ➕ Lower risk of follow-up churn from beta changes
• ➕ Potentially fewer unexpected API/tooling breakages
• ➖ May not align with the intended Kubernetes 1.37 rebase timeline
• ➖ Could require another bump soon anyway

2. Split into two PRs (deps/vendor vs CRD/tooling fixes)

• ➕ Easier review and rollback of purely mechanical vendor changes
• ➕ Allows focused review of functional tooling change
• ➖ Intermediate state may not build if tooling depends on the bump
• ➖ More coordination/CI cycles overall

Recommendation: For a 1.37 rebase branch, the combined bump + vendor refresh is coherent since vendoring must match the updated module graph. If review burden is a concern, consider splitting, but only if each PR preserves a buildable state.

Files changed (13) +391 / -340

Bug fix (1) +5 / -1

generator.goHandle ParseDocumentationFrom error return +5/-1

Handle ParseDocumentationFrom error return

• Adapts swagger docs generation to handle the new (docs, error) signature from kruntime.ParseDocumentationFrom, returning a contextual wrapped error on failure.

tools/codegen/pkg/swaggerdocs/generator.go

Other (12) +386 / -339

0000_10_openshift-controller-manager_01_builds.crd.yamlRegenerate builds CRD manifest docs +3/-1

Regenerate builds CRD manifest docs

• Updates generated schema documentation for the builds CRD (notably ConfigMapKeySelector key description) consistent with upstream Kubernetes OpenAPI doc changes.

config/v1/zz_generated.crd-manifests/0000_10_openshift-controller-manager_01_builds.crd.yaml

AAA_ungated.yamlRegenerate ungated builds CRD manifest docs +3/-1

Regenerate ungated builds CRD manifest docs

• Applies the same regenerated documentation updates for builds in the feature-gated manifest output.

config/v1/zz_generated.featuregated-crd-manifests/builds.config.openshift.io/AAA_ungated.yaml

0000_10_config-operator_01_clustermonitorings.crd.yamlRegenerate clustermonitorings CRD manifest docs +4/-6

Regenerate clustermonitorings CRD manifest docs

• Adjusts generated documentation text around dataSource/dataSourceRef and removes a prior beta feature-gate note, reflecting updated upstream schema docs.

config/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_clustermonitorings.crd.yaml

ClusterMonitoringConfig.yamlRegenerate feature-gated ClusterMonitoringConfig CRD docs +4/-6

Regenerate feature-gated ClusterMonitoringConfig CRD docs

• Mirrors the clustermonitorings CRD documentation updates in the feature-gated manifest variant.

config/v1alpha1/zz_generated.featuregated-crd-manifests/clustermonitorings.config.openshift.io/ClusterMonitoringConfig.yaml

go.modBump root Kubernetes and related dependencies +15/-14

Bump root Kubernetes and related dependencies

• Updates k8s.io/api and k8s.io/apimachinery to v0.37.0-beta.0 and refreshes related direct/indirect dependencies (x/*, kube-openapi, structured-merge-diff, etc.) to match the new Kubernetes dependency graph.

go.mod

go.sumRefresh root module checksums +28/-41

Refresh root module checksums

• Updates go.sum entries for the new dependency versions introduced by the Kubernetes bump.

go.sum

0000_10_config-operator_01_clustermonitorings.crd.yamlSync payload clustermonitorings CRD with regenerated output +4/-6

Sync payload clustermonitorings CRD with regenerated output

• Updates the payload-shipped CRD YAML to match the regenerated schema/docs for clustermonitorings.

payload-manifests/crds/0000_10_config-operator_01_clustermonitorings.crd.yaml

0000_10_openshift-controller-manager_01_builds.crd.yamlSync payload builds CRD with regenerated output +3/-1

Sync payload builds CRD with regenerated output

• Updates the payload-shipped builds CRD YAML to match regenerated documentation changes.

payload-manifests/crds/0000_10_openshift-controller-manager_01_builds.crd.yaml

go.modBump tools module Kubernetes/tooling deps and controller-tools replace +49/-48

Bump tools module Kubernetes/tooling deps and controller-tools replace

• Updates tools dependencies to Kubernetes v0.37.0-beta.0-era versions, bumps supporting tooling libraries, and changes the controller-tools replace directive to a different fork/commit for compatibility.

tools/go.mod

go.sumRefresh tools module checksums +149/-110

Refresh tools module checksums

• Updates tools/go.sum for the revised toolchain and Kubernetes-related dependencies.

tools/go.sum

modules.txtSync tools vendored module manifest +101/-82

Sync tools vendored module manifest

• Updates tools/vendor/modules.txt to reflect new tool dependency versions after vendoring.

tools/vendor/modules.txt

modules.txtSync vendored module manifest +23/-23

Sync vendored module manifest

• Updates vendor/modules.txt to reflect new dependency versions and explicitness metadata after vendoring.

vendor/modules.txt

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tools/go.mod`:
- Around line 16-36: Add an explicit provenance-review requirement for the
replace directive targeting
github.com/jacobsee/kubernetes-sigs-controller-tools: obtain approval, review
the fork against upstream, complete license and CVE checks, and compare
generated CRD/OpenAPI output before merging. Keep the existing controller-tools
dependency and replacement unchanged unless those reviews identify a required
update.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== tools/go.mod ==\n'
cat -n tools/go.mod | sed -n '1,120p'

printf '\n== tools/tools.go ==\n'
cat -n tools/tools.go | sed -n '1,120p'

printf '\n== search for controller-tools references ==\n'
rg -n "controller-tools|controller-gen|jacobsee/kubernetes-sigs-controller-tools|openshift/controller-tools" -S .

Repository: openshift/api

Length of output: 50369

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== module metadata ==\n'
go env GOMOD GOPATH GOMODCACHE 2>/dev/null || true

printf '\n== tools/go.mod replace block ==\n'
sed -n '1,80p' tools/go.mod

printf '\n== minimal dependency graph for controller-tools if available ==\n'
cd tools
if command -v go >/dev/null 2>&1; then
  go list -m all 2>/dev/null | rg 'controller-tools|controller-gen|jacobsee|openshift' || true
else
  echo "go tool not available"
fi

Repository: openshift/api

Length of output: 3989

---

Require provenance review for the controller-tools fork. This replace swaps upstream sigs.k8s.io/controller-tools for the github.com/jacobsee/kubernetes-sigs-controller-tools fork, so it changes the code-generation supply chain and can alter CRD/OpenAPI output. Require explicit provenance approval, an upstream diff review, license/CVE checks, and a generated-output comparison before merging.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/go.mod` around lines 16 - 36, Add an explicit provenance-review
requirement for the replace directive targeting
github.com/jacobsee/kubernetes-sigs-controller-tools: obtain approval, review
the fork against upstream, complete license and CVE checks, and compare
generated CRD/OpenAPI output before merging. Keep the existing controller-tools
dependency and replacement unchanged unless those reviews identify a required
update.

Source: Path instructions

[qodo-for-rh-openshift]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

1. Forked controller-tools dependency ✓ Resolved 🐞 Bug ⛨ Security

Description

tools/go.mod replaces sigs.k8s.io/controller-tools with
github.com/jacobsee/kubernetes-sigs-controller-tools, changing the provenance of controller-gen used
for code/CRD generation. Without an in-repo rationale/approval trail, this makes the toolchain
harder to audit and can affect reproducibility of generated outputs.

Code

tools/go.mod[R35-36]

+// replace sigs.k8s.io/controller-tools => github.com/openshift/controller-tools v0.12.1-0.20260526085915-0d87bdec1548
+replace sigs.k8s.io/controller-tools => github.com/jacobsee/kubernetes-sigs-controller-tools v0.0.0-20260723054157-031a71242c33

Relevance

● Weak

Repo intentionally uses forked controller-tools already (PR #2478, #2658); fork provenance is
established pattern.

PR-#2478
PR-#2658

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The tools module explicitly redirects controller-tools to a fork, and the tools vendoring metadata
records that the forked module is what will be used during builds/generation.

tools/go.mod[29-36]
tools/vendor/modules.txt[2492-2500]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`tools/go.mod` uses a `replace` directive to redirect `sigs.k8s.io/controller-tools` to a GitHub fork (`github.com/jacobsee/kubernetes-sigs-controller-tools`). This changes the provenance of the `controller-gen` tool used for generation, and there is no in-repo justification indicating why the fork is required.

### Issue Context
This replacement is reflected in the vendored module metadata, meaning it directly affects the pinned toolchain used in this repo.

### Fix Focus Areas
- tools/go.mod[35-36]
- tools/vendor/modules.txt[2492-2500]

### Expected fix
- Prefer removing the `replace` and using upstream `sigs.k8s.io/controller-tools` (or an organization-approved fork), **or** add a clear comment explaining why this fork is required and how it is vetted.
- After changing the replace, run the usual Go module/vendor refresh for the tools module so `tools/go.sum` and `tools/vendor/` match the new source.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context used

✅ Compliance rules (platform): 29 rules

✅ Skills: api-review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[jubittajohn]

/pipeline required

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-hypershift
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-techpreview
/test e2e-aws-serial-1of2
/test e2e-aws-serial-2of2
/test e2e-aws-serial-techpreview-1of2
/test e2e-aws-serial-techpreview-2of2
/test e2e-azure
/test e2e-gcp
/test e2e-upgrade
/test e2e-upgrade-out-of-change
/test minor-e2e-upgrade-minor

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[openshift-ci]

@jacobsee: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn-hypershift	cebda33	link	true	/test e2e-aws-ovn-hypershift
ci/prow/verify-hypershift-integration	cfe07ec	link	true	/test verify-hypershift-integration
ci/prow/verify-client-go	cfe07ec	link	true	/test verify-client-go

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.