WIP: Rebase 1.37

[jacobsee]

No description provided.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci]

Hello @jacobsee! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

[coderabbitai]

📝 Walkthrough

Walkthrough

Updated application and tooling Go dependencies, including the controller-tools replacement target. Revised CRD schema descriptions for volume data sources and ConfigMap binary keys. Added error handling to swagger documentation parsing so generation reports the affected types*.go file when parsing fails.

Suggested reviewers: joelspeed

🚥 Pre-merge checks | ✅ 13 | ❌ 2

❌ Failed checks (2 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title is generic and only indicates a rebase, without describing the actual changes.	Use a concise title that names the primary change, such as dependency bumps or CRD documentation updates.
Description check	❓ Inconclusive	No description was provided, so there is nothing meaningful to assess beyond the missing PR body.	Add a brief description summarizing the main changes and intent of the pull request.

✅ Passed checks (13 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No test files changed; the three changed spec.go files are library/spec code and contain no Ginkgo declarations.
Test Structure And Quality	✅ Passed	The PR only changes generated CRD/OpenAPI artifacts; no Ginkgo test code was modified, so this checklist is not applicable.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the PR only updates generated manifests/openapi and a generator method, with no MicroShift-sensitive test code.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the diff only changes generator code and CRD/OpenAPI docs, so SNO assumptions aren’t applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The PR only updates deps, generated CRD/OpenAPI docs, and swagger-doc parsing; no deployment manifests, controllers, or new scheduling constraints were added.
Ote Binary Stdout Contract	✅ Passed	No OTE main/init/TestMain/suite code writes to stdout; generator.go only adds error handling, and the new stdout call is in a vendored codegen helper, not the entrypoint.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo/e2e test files or network-sensitive test code were added; the diff is limited to docs, generated manifests, and dependency/codegen updates.
No-Weak-Crypto	✅ Passed	PASS: The diff only touches manifests/generated docs; no added lines contain MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret compares.
Container-Privileges	✅ Passed	Touched files only update docs, deps, and generator error handling; no privileged/container security fields appear in them.
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The diff only updates generated CRD/OpenAPI descriptions and schema refs; no logging calls or sensitive-data output was added.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

go.mod

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

payload-manifests/crds/0000_10_config-operator_01_clustermonitorings.crd.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

payload-manifests/crds/0000_10_openshift-controller-manager_01_builds.crd.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

• 1 others

🔧 golangci-lint (2.12.2)

Error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented
The command is terminated due to an error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign deads2k for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[qodo-for-rh-openshift]

PR Summary by Qodo

Bump Kubernetes deps to v0.37.0-beta.0 and re-vendor

⚙️ Configuration changes ✨ Enhancement 🕐 40+ Minutes

AI Description

• Update k8s.io/* modules (and related Go deps) to v0.37.0-beta.0.
• Re-vendor root and tools modules to match the new dependency graph.
• Regenerate CRD manifests and fix swaggerdocs codegen for new API errors.

Diagram

graph TD
  A["K8s deps v0.37"] --> B["go.mod files"] --> C["go mod vendor"] --> D["vendored deps"]
  B --> E["swaggerdocs gen"] --> F["CRD YAML"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Target stable v0.37.0 instead of beta

• ➕ Lower risk of follow-up churn from beta changes
• ➕ Potentially fewer unexpected API/tooling breakages
• ➖ May not align with the intended Kubernetes 1.37 rebase timeline
• ➖ Could require another bump soon anyway

2. Split into two PRs (deps/vendor vs CRD/tooling fixes)

• ➕ Easier review and rollback of purely mechanical vendor changes
• ➕ Allows focused review of functional tooling change
• ➖ Intermediate state may not build if tooling depends on the bump
• ➖ More coordination/CI cycles overall

Recommendation: For a 1.37 rebase branch, the combined bump + vendor refresh is coherent since vendoring must match the updated module graph. If review burden is a concern, consider splitting, but only if each PR preserves a buildable state.

Files changed (13) +391 / -340

Bug fix (1) +5 / -1

generator.goHandle ParseDocumentationFrom error return +5/-1

Handle ParseDocumentationFrom error return

• Adapts swagger docs generation to handle the new (docs, error) signature from kruntime.ParseDocumentationFrom, returning a contextual wrapped error on failure.

tools/codegen/pkg/swaggerdocs/generator.go

Other (12) +386 / -339

0000_10_openshift-controller-manager_01_builds.crd.yamlRegenerate builds CRD manifest docs +3/-1

Regenerate builds CRD manifest docs

• Updates generated schema documentation for the builds CRD (notably ConfigMapKeySelector key description) consistent with upstream Kubernetes OpenAPI doc changes.

config/v1/zz_generated.crd-manifests/0000_10_openshift-controller-manager_01_builds.crd.yaml

AAA_ungated.yamlRegenerate ungated builds CRD manifest docs +3/-1

Regenerate ungated builds CRD manifest docs

• Applies the same regenerated documentation updates for builds in the feature-gated manifest output.

config/v1/zz_generated.featuregated-crd-manifests/builds.config.openshift.io/AAA_ungated.yaml

0000_10_config-operator_01_clustermonitorings.crd.yamlRegenerate clustermonitorings CRD manifest docs +4/-6

Regenerate clustermonitorings CRD manifest docs

• Adjusts generated documentation text around dataSource/dataSourceRef and removes a prior beta feature-gate note, reflecting updated upstream schema docs.

config/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_clustermonitorings.crd.yaml

ClusterMonitoringConfig.yamlRegenerate feature-gated ClusterMonitoringConfig CRD docs +4/-6

Regenerate feature-gated ClusterMonitoringConfig CRD docs

• Mirrors the clustermonitorings CRD documentation updates in the feature-gated manifest variant.

config/v1alpha1/zz_generated.featuregated-crd-manifests/clustermonitorings.config.openshift.io/ClusterMonitoringConfig.yaml

go.modBump root Kubernetes and related dependencies +15/-14

Bump root Kubernetes and related dependencies

• Updates k8s.io/api and k8s.io/apimachinery to v0.37.0-beta.0 and refreshes related direct/indirect dependencies (x/*, kube-openapi, structured-merge-diff, etc.) to match the new Kubernetes dependency graph.

go.mod

go.sumRefresh root module checksums +28/-41

Refresh root module checksums

• Updates go.sum entries for the new dependency versions introduced by the Kubernetes bump.

go.sum

0000_10_config-operator_01_clustermonitorings.crd.yamlSync payload clustermonitorings CRD with regenerated output +4/-6

Sync payload clustermonitorings CRD with regenerated output

• Updates the payload-shipped CRD YAML to match the regenerated schema/docs for clustermonitorings.

payload-manifests/crds/0000_10_config-operator_01_clustermonitorings.crd.yaml

0000_10_openshift-controller-manager_01_builds.crd.yamlSync payload builds CRD with regenerated output +3/-1

Sync payload builds CRD with regenerated output

• Updates the payload-shipped builds CRD YAML to match regenerated documentation changes.

payload-manifests/crds/0000_10_openshift-controller-manager_01_builds.crd.yaml

go.modBump tools module Kubernetes/tooling deps and controller-tools replace +49/-48

Bump tools module Kubernetes/tooling deps and controller-tools replace

• Updates tools dependencies to Kubernetes v0.37.0-beta.0-era versions, bumps supporting tooling libraries, and changes the controller-tools replace directive to a different fork/commit for compatibility.

tools/go.mod

go.sumRefresh tools module checksums +149/-110

Refresh tools module checksums

• Updates tools/go.sum for the revised toolchain and Kubernetes-related dependencies.

tools/go.sum

modules.txtSync tools vendored module manifest +101/-82

Sync tools vendored module manifest

• Updates tools/vendor/modules.txt to reflect new tool dependency versions after vendoring.

tools/vendor/modules.txt

modules.txtSync vendored module manifest +23/-23

Sync vendored module manifest

• Updates vendor/modules.txt to reflect new dependency versions and explicitness metadata after vendoring.

vendor/modules.txt

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tools/go.mod`:
- Around line 16-36: Add an explicit provenance-review requirement for the
replace directive targeting
github.com/jacobsee/kubernetes-sigs-controller-tools: obtain approval, review
the fork against upstream, complete license and CVE checks, and compare
generated CRD/OpenAPI output before merging. Keep the existing controller-tools
dependency and replacement unchanged unless those reviews identify a required
update.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== tools/go.mod ==\n'
cat -n tools/go.mod | sed -n '1,120p'

printf '\n== tools/tools.go ==\n'
cat -n tools/tools.go | sed -n '1,120p'

printf '\n== search for controller-tools references ==\n'
rg -n "controller-tools|controller-gen|jacobsee/kubernetes-sigs-controller-tools|openshift/controller-tools" -S .

Repository: openshift/api

Length of output: 50369

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== module metadata ==\n'
go env GOMOD GOPATH GOMODCACHE 2>/dev/null || true

printf '\n== tools/go.mod replace block ==\n'
sed -n '1,80p' tools/go.mod

printf '\n== minimal dependency graph for controller-tools if available ==\n'
cd tools
if command -v go >/dev/null 2>&1; then
  go list -m all 2>/dev/null | rg 'controller-tools|controller-gen|jacobsee|openshift' || true
else
  echo "go tool not available"
fi

Repository: openshift/api

Length of output: 3989

---

Require provenance review for the controller-tools fork. This replace swaps upstream sigs.k8s.io/controller-tools for the github.com/jacobsee/kubernetes-sigs-controller-tools fork, so it changes the code-generation supply chain and can alter CRD/OpenAPI output. Require explicit provenance approval, an upstream diff review, license/CVE checks, and a generated-output comparison before merging.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/go.mod` around lines 16 - 36, Add an explicit provenance-review
requirement for the replace directive targeting
github.com/jacobsee/kubernetes-sigs-controller-tools: obtain approval, review
the fork against upstream, complete license and CVE checks, and compare
generated CRD/OpenAPI output before merging. Keep the existing controller-tools
dependency and replacement unchanged unless those reviews identify a required
update.

Source: Path instructions

[qodo-for-rh-openshift]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 29 rules

✅ Skills: api-review

1. Forked controller-tools dependency 🐞 Bug ⛨ Security

Description

tools/go.mod replaces sigs.k8s.io/controller-tools with
github.com/jacobsee/kubernetes-sigs-controller-tools, changing the provenance of controller-gen used
for code/CRD generation. Without an in-repo rationale/approval trail, this makes the toolchain
harder to audit and can affect reproducibility of generated outputs.

Code

tools/go.mod[R35-36]

+// replace sigs.k8s.io/controller-tools => github.com/openshift/controller-tools v0.12.1-0.20260526085915-0d87bdec1548
+replace sigs.k8s.io/controller-tools => github.com/jacobsee/kubernetes-sigs-controller-tools v0.0.0-20260723054157-031a71242c33

Relevance

⭐ Low

Repo intentionally uses forked controller-tools already (PR #2478, #2658); fork provenance is
established pattern.

PR-#2478
PR-#2658

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The tools module explicitly redirects controller-tools to a fork, and the tools vendoring metadata
records that the forked module is what will be used during builds/generation.

tools/go.mod[29-36]
tools/vendor/modules.txt[2492-2500]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`tools/go.mod` uses a `replace` directive to redirect `sigs.k8s.io/controller-tools` to a GitHub fork (`github.com/jacobsee/kubernetes-sigs-controller-tools`). This changes the provenance of the `controller-gen` tool used for generation, and there is no in-repo justification indicating why the fork is required.

### Issue Context
This replacement is reflected in the vendored module metadata, meaning it directly affects the pinned toolchain used in this repo.

### Fix Focus Areas
- tools/go.mod[35-36]
- tools/vendor/modules.txt[2492-2500]

### Expected fix
- Prefer removing the `replace` and using upstream `sigs.k8s.io/controller-tools` (or an organization-approved fork), **or** add a clear comment explaining why this fork is required and how it is vetted.
- After changing the replace, run the usual Go module/vendor refresh for the tools module so `tools/go.sum` and `tools/vendor/` match the new source.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[openshift-ci]

@jacobsee: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/verify-client-go	cebda33	link	true	/test verify-client-go
ci/prow/verify-hypershift-integration	cebda33	link	true	/test verify-hypershift-integration

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.