STOR-3011: Implement CSO upgrade check and Prometheus alerts for SELinuxMount readiness#714
Merged
openshift-merge-bot[bot] merged 10 commits intoJul 8, 2026
Merged
Conversation
- Introduced a new alert `SELinuxMountGAReadinessWorkloadsDetected` to monitor workloads with SELinux volume conflicts, providing a summary and runbook URL for remediation. - Integrated the SELinuxMount readiness controller into both Standalone and HyperShift operator starters to enhance monitoring capabilities.
openshift-ci-robot
added
the
jira/valid-reference
Contributor
|
@rvagner78: This pull request references STOR-3011 which is a valid jira issue. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
Contributor
|
Skipping CI for Draft Pull Request. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughA feature-gated SELinux mount readiness controller was added to read ChangesSELinux mount readiness
Estimated code review effort: 3 (Moderate) | ~25 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
pkg/operator/selinuxmountreadiness/controller.go (1)
114-151: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winDeduplicate conflict parsing. The method
conflictsPresent(lines 122-128) and the exportedConflictsPresent(lines 146-150) implement identical key-lookup andConditionTruecomparison. Have the method delegate to the exported function so the parsing contract stays single-sourced and the tests incontroller_test.goactually cover the production path.♻️ Proposed refactor
func (c *Controller) conflictsPresent() (present bool, found bool, err error) { cm, err := c.configMapLister.Get(selinuxConflictsConfigMapName) if apierrors.IsNotFound(err) { return false, false, nil } if err != nil { return false, false, err } - value, ok := cm.Data[selinuxConflictsDataKey] - if !ok { - klog.V(2).Infof("ConfigMap %s/%s exists but is missing key %q, treating as no conflicts", - csoclients.CloudConfigNamespace, selinuxConflictsConfigMapName, selinuxConflictsDataKey) - return false, true, nil - } - return metav1.ConditionStatus(value) == metav1.ConditionTrue, true, nil + present, found = ConflictsPresent(cm) + if found && cm.Data[selinuxConflictsDataKey] == "" { + klog.V(2).Infof("ConfigMap %s/%s exists but is missing key %q, treating as no conflicts", + csoclients.CloudConfigNamespace, selinuxConflictsConfigMapName, selinuxConflictsDataKey) + } + return present, found, nil }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/operator/selinuxmountreadiness/controller.go` around lines 114 - 151, The conflict parsing logic is duplicated between conflictsPresent and ConflictsPresent, so update conflictsPresent to delegate to ConflictsPresent after retrieving the ConfigMap and handling NotFound/errors. Keep the ConfigMap lookup and missing-key logging in conflictsPresent, but centralize the key lookup and metav1.ConditionTrue check in ConflictsPresent so the parsing behavior stays single-sourced and controller_test.go covers the production path.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@manifests/09_selinux-mount-readiness-configmap-reader-role.yaml`:
- Around line 16-25: The ConfigMap Role is too narrowly scoped for the
unfiltered informer used by selinux mount readiness. In
pkg/operator/selinuxmountreadiness/controller.go, the ConfigMap informer created
via InformersFor(...).Core().V1().ConfigMaps().Informer() LIST/WATCHes all
ConfigMaps, so update the RBAC in
manifests/09_selinux-mount-readiness-configmap-reader-role.yaml to keep get
restricted to selinux-conflicts but allow list/watch without resourceNames, or
alternatively change the informer to use a fieldSelector for
metadata.name=selinux-conflicts so the current scoping still works.
In `@manifests/12_prometheusrules.yaml`:
- Around line 95-106: The SELinuxMount readiness alert’s runbook link is
pointing to an enhancement document instead of a published operational runbook.
Update the SELinuxMountGAReadinessWorkloadsDetected alert annotation in the
Prometheus rules to use a valid openshift/runbooks URL (or an approved KCS
article) that SREs can act on, matching the pattern used by the other alerts in
this file.
In `@pkg/operator/selinuxmountreadiness/controller.go`:
- Around line 32-33: Replace the placeholder KCSArticleURL with the final
customer-facing runbook/KCS link before GA, since upgradeBlockedMessage() and
the alert runbook_url surface it directly to users. Update the constant in
controller.go to point to the published support article, and verify any
references in the selinuxmountreadiness controller and related alerting code
continue to use KCSArticleURL so the change is centralized.
---
Nitpick comments:
In `@pkg/operator/selinuxmountreadiness/controller.go`:
- Around line 114-151: The conflict parsing logic is duplicated between
conflictsPresent and ConflictsPresent, so update conflictsPresent to delegate to
ConflictsPresent after retrieving the ConfigMap and handling NotFound/errors.
Keep the ConfigMap lookup and missing-key logging in conflictsPresent, but
centralize the key lookup and metav1.ConditionTrue check in ConflictsPresent so
the parsing behavior stays single-sourced and controller_test.go covers the
production path.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: b0f5d8f0-da7a-4e5b-b5ef-2937e1faaa1c
📒 Files selected for processing (5)
manifests/09_selinux-mount-readiness-configmap-reader-role.yamlmanifests/12_prometheusrules.yamlpkg/operator/operator_starter.gopkg/operator/selinuxmountreadiness/controller.gopkg/operator/selinuxmountreadiness/controller_test.go
Comment on lines
+95
to
+106
| - alert: SELinuxMountGAReadinessWorkloadsDetected | ||
| expr: sum(cluster:selinux_warning_controller_selinux_volume_conflict:count) > 0 | ||
| for: 10m | ||
| labels: | ||
| severity: warning | ||
| annotations: | ||
| summary: "Workloads incompatible with SELinuxMount GA detected" | ||
| description: | | ||
| Pods with SELinux volume conflicts were detected. These workloads may fail to start | ||
| after upgrade when SELinuxMount becomes GA. Query metric | ||
| selinux_warning_controller_selinux_volume_conflict to list affected pods. | ||
| runbook_url: https://github.com/openshift/enhancements/blob/master/enhancements/storage/selinuxmount-ga-block-upgrade.md |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
runbook_url should point to a published runbook. The other alerts in this file reference github.com/openshift/runbooks/.... This new alert links to an enhancement doc, which won't pass the usual runbook-link expectations and isn't actionable for SREs. Align it with an openshift/runbooks entry (or a KCS article) before merge.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@manifests/12_prometheusrules.yaml` around lines 95 - 106, The SELinuxMount
readiness alert’s runbook link is pointing to an enhancement document instead of
a published operational runbook. Update the
SELinuxMountGAReadinessWorkloadsDetected alert annotation in the Prometheus
rules to use a valid openshift/runbooks URL (or an approved KCS article) that
SREs can act on, matching the pattern used by the other alerts in this file.
Contributor
There was a problem hiding this comment.
coderabbit is right here, we should create a PR in openshift/runbooks. I created a new story https://redhat.atlassian.net/browse/STOR-3027
There was a problem hiding this comment.
@jsafrane, thanks for confirming — good call. The enhancement doc isn't actionable for SREs, so having a proper runbook entry is the right fix.
Once the runbook PR in openshift/runbooks is merged, the runbook_url here should be updated to point to it (following the pattern of the other alerts in this file, e.g. https://github.com/openshift/runbooks/blob/master/alerts/cluster-monitoring-operator/<AlertName>.md). That can be done in a follow-up PR linked to STOR-3027.
Would you also like me to open a GitHub issue in this repository to track the runbook URL update alongside STOR-3027?
Comment on lines
+32
to
+33
| // KCSArticleURL is linked from Prometheus alerts. Update when the KCS article is published. | ||
| KCSArticleURL = "https://github.com/openshift/enhancements/blob/master/enhancements/storage/selinuxmount-ga-block-upgrade.md" |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Placeholder runbook URL surfaced to users. KCSArticleURL points to an enhancement doc, not a customer runbook, yet it is embedded in upgradeBlockedMessage() (operator condition) and the alert runbook_url. Track replacing this before GA so customers are not directed to a developer enhancement doc.
Want me to open an issue to track publishing the KCS article and swapping in the final URL?
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pkg/operator/selinuxmountreadiness/controller.go` around lines 32 - 33,
Replace the placeholder KCSArticleURL with the final customer-facing runbook/KCS
link before GA, since upgradeBlockedMessage() and the alert runbook_url surface
it directly to users. Update the constant in controller.go to point to the
published support article, and verify any references in the
selinuxmountreadiness controller and related alerting code continue to use
KCSArticleURL so the change is centralized.
- Updated the expression for the `SELinuxMountGAReadinessWorkloadsDetected` alert to calculate the number of conflicting pods more accurately by using floor(sum/2). - Enhanced alert annotations to provide clearer information on the number of pods with SELinux conflicts and included a query metric for affected pods.
jsafrane
reviewed
Jun 24, 2026
| @@ -0,0 +1,48 @@ | |||
| apiVersion: rbac.authorization.k8s.io/v1 | |||
Contributor
There was a problem hiding this comment.
CSO already has cluster-admin in the standalone clusters from here.
IMO this role does not does nothing.
Contributor
Author
There was a problem hiding this comment.
yes, it does make much sense right now, however there is a TODO item "remove cluster-admin from the operator, then a specific UID won't be needed." in manifests/10_deployment.yaml, so i guess that is the reason why it was added, to indicate that operator needs just read CM selinux-conflicts. But it can be removed for now.
Contributor
There was a problem hiding this comment.
Since we're going to remove the controller in 5.1, I think this RBAC will be useless much earlier than we finally implement fine-grained RBAC roles.
jsafrane
reviewed
Jun 24, 2026
Comment on lines
+95
to
+106
| - alert: SELinuxMountGAReadinessWorkloadsDetected | ||
| expr: sum(cluster:selinux_warning_controller_selinux_volume_conflict:count) > 0 | ||
| for: 10m | ||
| labels: | ||
| severity: warning | ||
| annotations: | ||
| summary: "Workloads incompatible with SELinuxMount GA detected" | ||
| description: | | ||
| Pods with SELinux volume conflicts were detected. These workloads may fail to start | ||
| after upgrade when SELinuxMount becomes GA. Query metric | ||
| selinux_warning_controller_selinux_volume_conflict to list affected pods. | ||
| runbook_url: https://github.com/openshift/enhancements/blob/master/enhancements/storage/selinuxmount-ga-block-upgrade.md |
Contributor
There was a problem hiding this comment.
coderabbit is right here, we should create a PR in openshift/runbooks. I created a new story https://redhat.atlassian.net/browse/STOR-3027
|
|
||
| // SELinuxMountGAReadinessFeatureGate gates the upgrade readiness check until | ||
| // openshift/api exposes features.FeatureGateSELinuxMountGAReadiness. | ||
| SELinuxMountGAReadinessFeatureGate = configv1.FeatureGateName("SELinuxMountGAReadiness") |
Contributor
There was a problem hiding this comment.
Bump openshift/api once openshift/api#2882 is merged and import the feature gate from there.
Contributor
There was a problem hiding this comment.
It's merged now (finally!)
| return factory.New().WithSync(c.sync).WithSyncDegradedOnError(clients.OperatorClient).WithInformers( | ||
| clients.OperatorClient.Informer(), | ||
| clients.KubeInformers.InformersFor(csoclients.CloudConfigNamespace).Core().V1().ConfigMaps().Informer(), | ||
| clients.ConfigInformers.Config().V1().FeatureGates().Informer(), |
Contributor
There was a problem hiding this comment.
The controller watches FeatureGate CR, but actually never reads it when it changes. It always uses the c.featureGates set at the controller creation.
What we usually do is that we read FeatureGates at the operator start and don't start a whole controller if the controller is not enabled.
And when FeatureGates change, we exit() and newly started operator fetches a fresh value. See an example and docs
Contributor
There was a problem hiding this comment.
I can see CSO already has a featureGateAccessor. So just remove the informer here and it should be OK. The accessor will exit() when the gates change.
Comment on lines
+140
to
+151
| // ConflictsPresent reports whether the selinux-conflicts ConfigMap indicates conflicts. | ||
| // It is exported for unit tests. | ||
| func ConflictsPresent(cm *corev1.ConfigMap) (present bool, found bool) { | ||
| if cm == nil { | ||
| return false, false | ||
| } | ||
| value, ok := cm.Data[selinuxConflictsDataKey] | ||
| if !ok { | ||
| return false, true | ||
| } | ||
| return metav1.ConditionStatus(value) == metav1.ConditionTrue, true | ||
| } |
Contributor
There was a problem hiding this comment.
Is this function used anywhere?
Contributor
Author
There was a problem hiding this comment.
Fixed, renamed to conflictsPresentInConfigMap and used in conflictPresent() and also in unit tests.
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
pkg/operator/selinuxmountreadiness/controller.go (1)
132-148: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueRedundant key re-check after
conflictsPresentInConfigMap.conflictsPresentInConfigMapalready encodes the missing-key case (returnsfound=true,present=false); the inlinecm.Data[key]lookup here only duplicates that logic for logging. Consider folding the log into the helper or dropping it. Low priority.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/operator/selinuxmountreadiness/controller.go` around lines 132 - 148, `conflictsPresent` is re-checking the ConfigMap key after `conflictsPresentInConfigMap` has already determined the missing-key case, so the logic is duplicated. Update `conflictsPresent` to rely on the `present`/`found` result from `conflictsPresentInConfigMap` and remove the extra `cm.Data[selinuxConflictsDataKey]` lookup, or move the logging into `conflictsPresentInConfigMap` if you still want that diagnostic message.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pkg/operator/selinuxmountreadiness/controller_test.go`:
- Around line 203-210: The test setup in the selinuxmountreadiness controller
should register cleanup for stopCh immediately after it is created so it always
runs, even if cache sync fails. Move the defer close(stopCh) in the test around
RunConfigMapInformer, StartInformers, and WaitForSync so it is set before any
t.Fatal path, ensuring informer goroutines are stopped reliably.
---
Nitpick comments:
In `@pkg/operator/selinuxmountreadiness/controller.go`:
- Around line 132-148: `conflictsPresent` is re-checking the ConfigMap key after
`conflictsPresentInConfigMap` has already determined the missing-key case, so
the logic is duplicated. Update `conflictsPresent` to rely on the
`present`/`found` result from `conflictsPresentInConfigMap` and remove the extra
`cm.Data[selinuxConflictsDataKey]` lookup, or move the logging into
`conflictsPresentInConfigMap` if you still want that diagnostic message.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 49c39526-924b-445e-8d9d-98930e2de6c9
📒 Files selected for processing (4)
manifests/09_selinux-mount-readiness-configmap-reader-role.yamlpkg/operator/operator_starter.gopkg/operator/selinuxmountreadiness/controller.gopkg/operator/selinuxmountreadiness/controller_test.go
🚧 Files skipped from review as they are similar to previous changes (2)
- pkg/operator/operator_starter.go
- manifests/09_selinux-mount-readiness-configmap-reader-role.yaml
Contributor
Author
|
/test all |
jsafrane
reviewed
Jun 25, 2026
Contributor
Author
|
/test all |
Contributor
Author
|
/test e2e-azure-file-csi |
Contributor
|
@rvagner78: This PR was included in a payload test run from #715
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/7b96e9d0-7156-11f1-9c62-ad103feffb0c-0 |
jsafrane
reviewed
Jun 26, 2026
| return err | ||
| } | ||
|
|
||
| if selinuxmountreadiness.FeatureGateEnabled(ssr.featureGates) { |
Contributor
There was a problem hiding this comment.
Suggested change
| if selinuxmountreadiness.FeatureGateEnabled(ssr.featureGates) { | |
| if ssr.featureGates.Enabled(the feature gate from openshift/api) { |
And selinuxmountreadiness.FeatureGateEnabled and its unit test becomes useless.
(i would expect both cursor and coderabbit to spot this)
jsafrane
reviewed
Jun 26, 2026
| return err | ||
| } | ||
|
|
||
| if selinuxmountreadiness.FeatureGateEnabled(hsr.featureGates) { |
Contributor
There was a problem hiding this comment.
same as above, call hsrr.featureGates.Enabled
Vendor openshift/api to pick up FeatureGateSELinuxMountGAReadiness from openshift/api#2882 and gate the SELinux mount readiness controller with featureGates.Enabled() directly, removing the local FeatureGateEnabled wrapper and its unit test. Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
|
@rvagner78: This PR was included in a payload test run from #715
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/ecea6200-73be-11f1-80a5-d953eec5d313-0 |
Contributor
|
@rvagner78: This PR was included in a payload test run from #715
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/ff343440-7490-11f1-893c-a6a79a083dc4-0 |
Contributor
|
@jsafrane: This PR was included in a payload test run from #715
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/c7f7fb70-752a-11f1-8353-8747cb10a2fe-0 |
Contributor
|
@rvagner78: This PR was included in a payload test run from #715
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/5b0f6ec0-7544-11f1-86d8-78f0905bdb7b-0 |
jsafrane
reviewed
Jul 2, 2026
jsafrane
left a comment
jsafrane
left a comment
Contributor
There was a problem hiding this comment.
The informer creation seems to be not necessary, I hope the comments below make some sense.
Comment on lines
+49
to
+60
| configMapInformer := newSELinuxConflictsConfigMapInformer(clients.KubeClient) | ||
|
|
||
| c := &Controller{ | ||
| operatorClient: clients.OperatorClient, | ||
| configMapLister: corelisters.NewConfigMapLister(configMapInformer.GetIndexer()). | ||
| ConfigMaps(csoclients.CloudConfigNamespace), | ||
| eventRecorder: eventRecorder, | ||
| } | ||
| return factory.New().WithSync(c.sync).WithSyncDegradedOnError(clients.OperatorClient).WithInformers( | ||
| clients.OperatorClient.Informer(), | ||
| configMapInformer, | ||
| ).ToController("SELinuxMountGAReadinessController", eventRecorder), configMapInformer |
Contributor
There was a problem hiding this comment.
client.KubeInformers already watches namespace openshift-config, see how it's created here:
cluster-storage-operator/pkg/csoclients/csoclients.go
Lines 99 to 102 in 3a1c018
Therefore the whole informer creation here is useless. NewController does not need to return any informer and this will work:.
Suggested change
| configMapInformer := newSELinuxConflictsConfigMapInformer(clients.KubeClient) | |
| c := &Controller{ | |
| operatorClient: clients.OperatorClient, | |
| configMapLister: corelisters.NewConfigMapLister(configMapInformer.GetIndexer()). | |
| ConfigMaps(csoclients.CloudConfigNamespace), | |
| eventRecorder: eventRecorder, | |
| } | |
| return factory.New().WithSync(c.sync).WithSyncDegradedOnError(clients.OperatorClient).WithInformers( | |
| clients.OperatorClient.Informer(), | |
| configMapInformer, | |
| ).ToController("SELinuxMountGAReadinessController", eventRecorder), configMapInformer | |
| configMapInformer := clients.KubeInformers.InformersFor(csoclients.CloudConfigNamespace).Core().V1().ConfigMaps() | |
| c := &Controller{ | |
| operatorClient: clients.OperatorClient, | |
| configMapLister: configMapInformer.Lister(). | |
| ConfigMaps(csoclients.CloudConfigNamespace), | |
| eventRecorder: eventRecorder, | |
| } | |
| return factory.New().WithSync(c.sync).WithSyncDegradedOnError(clients.OperatorClient).WithInformers( | |
| clients.OperatorClient.Informer(), | |
| configMapInformer.Informer(), | |
| ).ToController("SELinuxMountGAReadinessController", eventRecorder) |
Contributor
There was a problem hiding this comment.
I admit, github rendering is not great.
Comment on lines
+69
to
+79
| func newSELinuxConflictsConfigMapInformer(kubeClient kubernetes.Interface) cache.SharedIndexInformer { | ||
| return coreinformers.NewFilteredConfigMapInformer( | ||
| kubeClient, | ||
| csoclients.CloudConfigNamespace, | ||
| configMapInformerResync, | ||
| cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, | ||
| func(listOptions *metav1.ListOptions) { | ||
| listOptions.FieldSelector = fields.OneTermEqualSelector("metadata.name", selinuxConflictsConfigMapName).String() | ||
| }, | ||
| ) | ||
| } |
Contributor
There was a problem hiding this comment.
this should not be necessary at all.
| if ssr.featureGates.Enabled(features.FeatureGateSELinuxMountGAReadiness) { | ||
| ctrl, configMapInformer := selinuxmountreadiness.NewController(ssr.commonClients, ssr.eventRecorder) | ||
| ssr.controllers = append(ssr.controllers, ctrl) | ||
| selinuxmountreadiness.RunConfigMapInformer(configMapInformer, ctx.Done()) |
Contributor
There was a problem hiding this comment.
selinuxmountreadiness.RunConfigMapInformer is not necessary, csoclients.StartInformers() below already starts csoclients.KubeInformers
…Drop the dedicated ConfigMap informer and RunConfigMapInformer; reuse the existing openshift-config informer from csoclients.
Contributor
|
@rvagner78: This PR was included in a payload test run from #715
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/7fe636d0-7624-11f1-80b2-733aebec6fcc-0 |
rvagner78
marked this pull request as ready for review
July 3, 2026 09:03
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
There was a problem hiding this comment.
🧹 Nitpick comments (1)
pkg/operator/operator_starter.go (1)
190-193: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winStale RBAC comment after informer refactor.
manifests/09_selinux-mount-readiness-configmap-reader-role.yamldocuments the list/watch rule with: "the controller uses a fieldSelector (metadata.name=selinux-conflicts) on its dedicated informer." Sincecontroller.gonow uses the sharedclients.KubeInformers(per this cohort's refactor) rather than a dedicated fieldSelector-based informer, that comment is now inaccurate and should be updated to avoid confusing future reviewers about RBAC scope rationale.Also applies to: 298-301
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/operator/operator_starter.go` around lines 190 - 193, The RBAC comment in the manifest file `manifests/09_selinux-mount-readiness-configmap-reader-role.yaml` is outdated and no longer reflects the current implementation. Update the comment that mentions the controller using a dedicated fieldSelector-based informer for "metadata.name=selinux-conflicts" to instead document that the controller now uses the shared clients.KubeInformers as a result of the informer refactor, removing the specific fieldSelector reference to avoid future confusion about the actual RBAC scope requirements.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@pkg/operator/operator_starter.go`:
- Around line 190-193: The RBAC comment in the manifest file
`manifests/09_selinux-mount-readiness-configmap-reader-role.yaml` is outdated
and no longer reflects the current implementation. Update the comment that
mentions the controller using a dedicated fieldSelector-based informer for
"metadata.name=selinux-conflicts" to instead document that the controller now
uses the shared clients.KubeInformers as a result of the informer refactor,
removing the specific fieldSelector reference to avoid future confusion about
the actual RBAC scope requirements.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 0477d208-4110-490e-b3bc-7e7dedb9bc93
⛔ Files ignored due to path filters (242)
go.sumis excluded by!**/*.sumvendor/github.com/openshift/api/.ci-operator.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/.golangci.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/Dockerfile.ocpis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/Makefileis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/apiextensions/v1alpha1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/apiextensions/v1alpha1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/apiserver/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/apiserver/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/apps/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/apps/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/authorization/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/authorization/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/build/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/build/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/cloudnetwork/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/cloudnetwork/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/register.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_apiserver.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_authentication.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_cluster_operator.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_cluster_version.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_crio_credential_provider_config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_dns.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_image.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_infrastructure.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_kmsencryption.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_network.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_tlssecurityprofile.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1alpha1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1alpha1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1alpha2/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1alpha2/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/console/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/console/v1/types_console_plugin.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/console/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/console/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/envtest-releases.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/etcd/install.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/etcd/v1/Makefileis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/etcd/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/etcd/v1/register.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/etcd/v1/types_pacemakercluster.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/etcd/v1/zz_generated.deepcopy.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/etcd/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/etcd/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/etcd/v1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/etcd/v1alpha1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/etcd/v1alpha1/types_pacemakercluster.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/etcd/v1alpha1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/etcd/v1alpha1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/features.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/features/features.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/helm/v1beta1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/helm/v1beta1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/image/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/image/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/imageregistry/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/imageregistry/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/install.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/kubecontrolplane/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/kubecontrolplane/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/legacyconfig/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/legacyconfig/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/machine/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/machine/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/machine/v1alpha1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/machine/v1alpha1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/machine/v1beta1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/machine/v1beta1/types_machineset.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/machine/v1beta1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/machine/v1beta1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/monitoring/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/monitoring/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/network/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/network/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/network/v1alpha1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/network/v1alpha1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/networkoperator/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/networkoperator/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/oauth/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/oauth/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/openshiftcontrolplane/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/openshiftcontrolplane/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/operator/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/types_authentication.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/types_csi_cluster_driver.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/types_etcd.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/types_ingresscontroller.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/types_kmsencryption.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/types_kubeapiserver.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/types_network.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/types_openshiftapiserver.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_12_etcd_01_etcds-CustomNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_12_etcd_01_etcds-DevPreviewNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_12_etcd_01_etcds-TechPreviewNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-CustomNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-Default.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-DevPreviewNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-OKD.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-TechPreviewNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_30_openshift-apiserver_01_openshiftapiservers-CustomNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_30_openshift-apiserver_01_openshiftapiservers-Default.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_30_openshift-apiserver_01_openshiftapiservers-DevPreviewNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_30_openshift-apiserver_01_openshiftapiservers-OKD.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_30_openshift-apiserver_01_openshiftapiservers-TechPreviewNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_authentication_01_authentications-CustomNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_authentication_01_authentications-Default.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_authentication_01_authentications-DevPreviewNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_authentication_01_authentications-OKD.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_authentication_01_authentications-TechPreviewNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-CustomNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-Default.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-DevPreviewNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-OKD.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-TechPreviewNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-TechPreviewNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks-CustomNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks-Default.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks-DevPreviewNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks-OKD.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks-TechPreviewNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/operator/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/operator/v1alpha1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1alpha1/types_clusterapi.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.deepcopy.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/operatorcontrolplane/v1alpha1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operatorcontrolplane/v1alpha1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/osin/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/osin/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/project/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/project/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/quota/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/quota/v1/generated.protois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/quota/v1/types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/quota/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/quota/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/route/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/route/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/samples/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/samples/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/security/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/security/v1/generated.protois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/security/v1/types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/security/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/security/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/security/v1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/servicecertsigner/v1alpha1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/servicecertsigner/v1alpha1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/sharedresource/v1alpha1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/sharedresource/v1alpha1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/template/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/template/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/user/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/user/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/k8s.io/kube-openapi/pkg/builder/openapi.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/builder3/openapi.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/serialization.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/README.mdis excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/alias.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_any.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_default.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_funcs.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_inlined.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_methods.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_time.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/decode.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/doc.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/encode.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/errors.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/fields.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/fold.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/intern.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/internal.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags/flags.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonopts/options.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire/decode.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire/encode.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire/wire.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/alias.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/decode.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/doc.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/encode.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/errors.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/export.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/options.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/pools.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/quote.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/state.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/token.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/value.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/migrate.shis excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/options.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/value.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/schemaconv/openapi.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/schemaconv/proto_models.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/spec3/encoding.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/spec3/example.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/spec3/external_documentation.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/spec3/header.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/spec3/media_type.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/spec3/operation.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/spec3/parameter.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/spec3/path.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/spec3/request_body.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/spec3/response.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/spec3/security_scheme.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/spec3/server.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/spec3/spec.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/validation/spec/header.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/validation/spec/info.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/validation/spec/items.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/validation/spec/operation.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/validation/spec/parameter.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/validation/spec/path_item.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/validation/spec/paths.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/validation/spec/response.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/validation/spec/responses.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/validation/spec/schema.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/validation/spec/security_scheme.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/validation/spec/swagger.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kube-openapi/pkg/validation/spec/tag.gois excluded by!**/vendor/**,!vendor/**vendor/modules.txtis excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (4)
go.modpkg/operator/operator_starter.gopkg/operator/selinuxmountreadiness/controller.gopkg/operator/selinuxmountreadiness/controller_test.go
Contributor
Author
|
/test e2e-aws-csi |
1 similar comment
Contributor
Author
|
/test e2e-aws-csi |
Contributor
|
/payload-job periodic-ci-openshift-release-main-ci-5.0-e2e-gcp-ovn-techpreview I want to see what the operator does without openshift/kubernetes#2671 |
Contributor
|
@jsafrane: trigger 2 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/9debbf90-76e4-11f1-8cfd-0e167484d108-0 |
Contributor
|
/lgtm |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jsafrane, rvagner78 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
Contributor
|
/retest |
Contributor
|
/verified-by @jsafrane I tested it also on hypershift + AWS. |
Contributor
|
@rvagner78: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Contributor
|
/verified by @jsafrane |
openshift-ci-robot
added
the
verified
Contributor
|
@jsafrane: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-merge-bot
Bot
merged commit Jul 8, 2026
8ac4825
into
openshift:main
16 of 17 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
selinux-conflictsConfigMap.