CM-825: release chore: Upstream bump for v1.19.2 and rebase for v1.19.0 release #358
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@PillaiManish: This pull request references CM-825 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
bot
added
the
do-not-merge/work-in-progress
WalkthroughUpgrades cert-manager from v1.18.3→v1.19.2 and Go toolchain from 1.24→1.25. Changes include dependency bumps, builder image tag updates, CRD schema extensions (list/map typing, new RFC2136 protocol, issuerRef description), bundle/operator metadata and many manifest image/version updates, plus small code and asset adjustments. Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Areas requiring extra attention:
✨ Finishing touches🧪 Generate unit tests (beta)
Comment |
|
@PillaiManish: This pull request references CM-825 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
PillaiManish
changed the title
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
There was a problem hiding this comment.
Thanks for your work. Some suggestions:
- Could we squash commits cd70d9e and 4e1e232 since they are doing the same thing?
- Along with this commit 7817403, we should also update this line: https://github.com/PillaiManish/cert-manager-operator/blob/e3cf35386610052dd0bf89303ccb4c1e7238d429/config/manifests/bases/cert-manager-operator.clusterserviceversion.yaml#L115
- It would be great if we could still keep the commit messages verbose like what we did in the past.
- Ideally we should bump with 1.19.2 which just got released days ago to reduce future work.
openshift-merge-robot
added
the
needs-rebase
https://github.com/openshift/jetstack-cert-manager/tags right now we dont have the required tag. |
openshift-merge-robot
removed
the
needs-rebase
PillaiManish
changed the title
|
@PillaiManish: This pull request references CM-825 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
🧹 Nitpick comments (5)
.idea/.gitignore (1)
1-8: Consider using repository-root .gitignore or global gitignore instead.IDE-specific configuration directories like
.idea/should typically not be committed to the repository. Different team members may use different IDEs (VS Code, vim, emacs, etc.), and IDE-specific ignore files create unnecessary repository clutter.Consider either:
- Adding these patterns to the repository's root
.gitignorefile, or- Using a global gitignore configuration (
~/.gitignore_global).idea/cert-manager-operator.iml (1)
1-4: Consider adding .idea/ to .gitignore.IDE configuration files are typically user-specific and can cause merge conflicts. Consider excluding the
.idea/directory unless the team has explicitly decided to version-control IDE settings.rebase_automation.sh (3)
13-14: Remove unusedREPO_ROOTvariable.
REPO_ROOTis defined but never referenced in the script. Based on static analysis (SC2034).SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" -REPO_ROOT="$SCRIPT_DIR"
358-361: Word boundary pattern may cause unintended matches.The pattern
\b${old_version}\bcould match version substrings in edge cases (e.g., "1.18.0" within a hypothetical "v1.18.0-rc1" or similar). Consider using more restrictive anchoring if precision is critical.
314-320: Array assignment from command substitution is fragile for filenames with spaces.Shellcheck SC2207: If any file has spaces or newlines in its name, word splitting will corrupt the array. In this OpenShift repo context, this is unlikely, but using
mapfilewith null-delimited find would be more robust.- local files_to_check=( - $(find . -type f \( -name "*.go" -o -name "*.yaml" -o -name "*.yml" -o -name "*.json" -o -name "*.md" -o -name "*.Dockerfile" \) \ - -not -path "./vendor/*" \ - -not -path "./.git/*" \ - -not -path "./testbin/*" \ - | grep -v "go.sum") - ) + local files_to_check=() + while IFS= read -r -d '' file; do + [[ "$file" != *"go.sum"* ]] && files_to_check+=("$file") + done < <(find . -type f \( -name "*.go" -o -name "*.yaml" -o -name "*.yml" -o -name "*.json" -o -name "*.md" -o -name "*.Dockerfile" \) \ + -not -path "./vendor/*" \ + -not -path "./.git/*" \ + -not -path "./testbin/*" \ + -print0)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting
⛔ Files ignored due to path filters (215)
go.sumis excluded by!**/*.sumvendor/cel.dev/expr/.bazelversionis excluded by!vendor/**,!**/vendor/**vendor/cel.dev/expr/MODULE.bazelis excluded by!vendor/**,!**/vendor/**vendor/cel.dev/expr/README.mdis excluded by!vendor/**,!**/vendor/**vendor/cel.dev/expr/cloudbuild.yamlis excluded by!vendor/**,!**/vendor/**vendor/cel.dev/expr/eval.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/CHANGES.mdis excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/auth.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/credentials/detect.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/credentials/filetypes.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/externalaccount.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/x509_provider.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/internal/credsfile/filetype.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/internal/transport/cba.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/internal/transport/cert/workload_cert.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/compute/metadata/CHANGES.mdis excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/compute/metadata/metadata.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/compute/metadata/retry.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/compute/metadata/syscheck.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/compute/metadata/syscheck_linux.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/compute/metadata/syscheck_windows.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/Masterminds/semver/v3/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/Masterminds/semver/v3/README.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/Masterminds/semver/v3/constraints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/Masterminds/semver/v3/version.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/auth_scheme_preference.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/config.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/env_config.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/load_options.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/provider.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/resolve.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/resolve_credentials.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/shared_config.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds/provider.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/endpointcreds/provider.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/processcreds/provider.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/ssocreds/sso_credentials_provider.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/static_provider.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/stscreds/assume_role_provider.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/stscreds/web_identity_provider.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/api_client.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/ini/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/ini/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_client.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_GetRoleCredentials.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_ListAccountRoles.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_ListAccounts.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_Logout.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/auth.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/deserializers.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/endpoints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/generated.jsonis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/internal/endpoints/endpoints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/options.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/serializers.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_client.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_CreateToken.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_CreateTokenWithIAM.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_RegisterClient.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_StartDeviceAuthorization.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/auth.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/deserializers.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/doc.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/endpoints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/generated.jsonis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/internal/endpoints/endpoints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/options.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/types/enums.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/types/errors.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/types/types.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_client.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRole.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoleWithSAML.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoleWithWebIdentity.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoot.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_DecodeAuthorizationMessage.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetAccessKeyInfo.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetCallerIdentity.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetFederationToken.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetSessionToken.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/auth.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/deserializers.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/endpoints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/generated.jsonis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/internal/endpoints/endpoints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/options.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/serializers.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/types/errors.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/validators.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v4/context.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v4/exponential.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v4/retry.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v4/tries.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v5/.gitignoreis excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v5/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v5/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v5/README.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v5/backoff.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v5/error.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v5/exponential.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v5/retry.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v5/ticker.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cenkalti/backoff/v5/timer.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/LICENSESis excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/acme/v1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/acme/v1/types_challenge.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/acme/v1/types_issuer.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/acme/v1/types_order.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/acme/v1/zz_generated.deepcopy.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1/types_certificate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1/types_certificaterequest.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1/types_issuer.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/meta/doc.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/meta/v1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/meta/v1/types.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/apis/meta/v1/zz_generated.deepcopy.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeauthorization.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallenge.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallengesolver.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallengesolverdns01.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallengesolverhttp01.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallengesolverhttp01gatewayhttproute.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallengesolverhttp01ingress.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallengesolverhttp01ingressobjectmeta.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallengesolverhttp01ingresspodobjectmeta.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallengesolverhttp01ingresspodresources.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallengesolverhttp01ingresspodsecuritycontext.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallengesolverhttp01ingresspodspec.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallengesolverhttp01ingresspodtemplate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmechallengesolverhttp01ingresstemplate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeexternalaccountbinding.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeissuer.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeissuerdns01provideracmedns.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeissuerdns01providerakamai.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeissuerdns01providerazuredns.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeissuerdns01providerclouddns.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeissuerdns01providercloudflare.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeissuerdns01providerdigitalocean.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeissuerdns01providerrfc2136.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeissuerdns01providerroute53.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeissuerdns01providerwebhook.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/acmeissuerstatus.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/azuremanagedidentity.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/certificatednsnameselector.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/challenge.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/challengespec.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/challengestatus.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/order.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/orderspec.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/orderstatus.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/route53auth.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/route53kubernetesauth.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/acme/v1/serviceaccountref.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/caissuer.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/certificate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/certificateadditionaloutputformat.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/certificatecondition.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/certificatekeystores.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/certificateprivatekey.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/certificaterequest.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/certificaterequestcondition.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/certificaterequestspec.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/certificaterequeststatus.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/certificatesecrettemplate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/certificatespec.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/certificatestatus.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/clusterissuer.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/issuer.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/issuercondition.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/issuerconfig.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/issuerspec.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/issuerstatus.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/jkskeystore.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/nameconstraintitem.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/nameconstraints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/othername.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/pkcs12keystore.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/selfsignedissuer.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/serviceaccountref.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/vaultapprole.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/vaultauth.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/vaultclientcertificateauth.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/vaultissuer.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/vaultkubernetesauth.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/venaficloud.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/venafiissuer.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/venafitpp.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/certmanager/v1/x509subject.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/internal/internal.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/meta/v1/issuerreference.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/meta/v1/localobjectreference.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/applyconfigurations/meta/v1/secretkeyselector.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/clientset/versioned/typed/acme/v1/acme_client.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/clientset/versioned/typed/acme/v1/challenge.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/clientset/versioned/typed/acme/v1/order.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/clientset/versioned/typed/certmanager/v1/certificate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/clientset/versioned/typed/certmanager/v1/certificaterequest.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/cert-manager/cert-manager/pkg/client/clientset/versioned/typed/certmanager/v1/certmanager_client.gois excluded by!vendor/**,!**/vendor/**
📒 Files selected for processing (85)
.ci-operator.yaml(1 hunks).idea/.gitignore(1 hunks).idea/cert-manager-operator.iml(1 hunks).idea/golinter.xml(1 hunks).idea/vcs.xml(1 hunks)Dockerfile(1 hunks)Makefile(2 hunks)api/operator/v1alpha1/zz_generated.deepcopy.go(1 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-cr.yaml(1 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-crb.yaml(1 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-deployment.yaml(3 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-leaderelection-rb.yaml(1 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-leaderelection-role.yaml(1 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-sa.yaml(1 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-svc.yaml(1 hunks)bindata/cert-manager-deployment/cert-manager/cert-manager-controller-approve-cert-manager-io-cr.yaml(1 hunks)bindata/cert-manager-deployment/cert-manager/cert-manager-controller-approve-cert-manager-io-crb.yaml(1 hunks)bindata/cert-manager-deployment/cert-manager/cert-manager-controller-certificatesigningrequests-cr.yaml(1 hunks)bindata/cert-manager-deployment/cert-manager/cert-manager-controller-certificatesigningrequests-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-cluster-view-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-certificates-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-certificates-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-challenges-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-challenges-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-clusterissuers-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-clusterissuers-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-ingress-shim-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-ingress-shim-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-issuers-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-issuers-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-orders-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-orders-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-deployment.yaml(3 hunks)bindata/cert-manager-deployment/controller/cert-manager-edit-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-leaderelection-rb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-leaderelection-role.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-sa.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-svc.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-tokenrequest-rb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-tokenrequest-role.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-view-cr.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-deployment.yaml(3 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-dynamic-serving-rb.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-dynamic-serving-role.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-mutatingwebhookconfiguration.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-sa.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-subjectaccessreviews-cr.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-subjectaccessreviews-crb.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-svc.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-validatingwebhookconfiguration.yaml(1 hunks)bundle.Dockerfile(1 hunks)bundle/manifests/acme.cert-manager.io_challenges.yaml(19 hunks)bundle/manifests/acme.cert-manager.io_orders.yaml(6 hunks)bundle/manifests/cert-manager-operator.clusterserviceversion.yaml(4 hunks)bundle/manifests/cert-manager.io_certificaterequests.yaml(5 hunks)bundle/manifests/cert-manager.io_certificates.yaml(14 hunks)bundle/manifests/cert-manager.io_clusterissuers.yaml(25 hunks)bundle/manifests/cert-manager.io_issuers.yaml(25 hunks)bundle/manifests/operator.openshift.io_certmanagers.yaml(7 hunks)bundle/manifests/operator.openshift.io_istiocsrs.yaml(4 hunks)bundle/metadata/annotations.yaml(1 hunks)config/crd/bases/certificaterequests.cert-manager.io-crd.yaml(5 hunks)config/crd/bases/certificates.cert-manager.io-crd.yaml(14 hunks)config/crd/bases/challenges.acme.cert-manager.io-crd.yaml(19 hunks)config/crd/bases/clusterissuers.cert-manager.io-crd.yaml(25 hunks)config/crd/bases/issuers.cert-manager.io-crd.yaml(25 hunks)config/crd/bases/operator.openshift.io_certmanagers.yaml(7 hunks)config/crd/bases/operator.openshift.io_istiocsrs.yaml(4 hunks)config/crd/bases/orders.acme.cert-manager.io-crd.yaml(6 hunks)config/manager/manager.yaml(1 hunks)config/manifests/bases/cert-manager-operator.clusterserviceversion.yaml(3 hunks)go.mod(11 hunks)images/ci/Dockerfile(1 hunks)images/ci/operand.Dockerfile(1 hunks)pkg/controller/deployment/cert_manager_controller_deployment.go(1 hunks)pkg/controller/deployment/deployment_overrides_test.go(3 hunks)pkg/controller/istiocsr/deployments_test.go(1 hunks)pkg/operator/applyconfigurations/internal/internal.go(1 hunks)pkg/operator/applyconfigurations/operator/v1alpha1/certmanager.go(2 hunks)pkg/operator/applyconfigurations/operator/v1alpha1/certmanagerconfig.go(2 hunks)pkg/operator/applyconfigurations/operator/v1alpha1/istiocsr.go(2 hunks)pkg/operator/applyconfigurations/utils.go(2 hunks)pkg/operator/assets/bindata.go(51 hunks)pkg/operator/clientset/versioned/fake/clientset_generated.go(1 hunks)rebase_automation.sh(1 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
**
⚙️ CodeRabbit configuration file
-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.
Files:
bindata/cert-manager-deployment/controller/cert-manager-controller-certificates-crb.yamlbundle.Dockerfilepkg/operator/clientset/versioned/fake/clientset_generated.gobindata/cert-manager-deployment/controller/cert-manager-controller-issuers-cr.yamlbindata/cert-manager-deployment/controller/cert-manager-leaderelection-role.yamlimages/ci/Dockerfilebindata/cert-manager-deployment/webhook/cert-manager-webhook-validatingwebhookconfiguration.yamlbindata/cert-manager-deployment/cert-manager/cert-manager-controller-approve-cert-manager-io-crb.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-clusterissuers-crb.yamlbindata/cert-manager-deployment/webhook/cert-manager-webhook-svc.yamlbindata/cert-manager-deployment/webhook/cert-manager-webhook-dynamic-serving-rb.yamlbindata/cert-manager-deployment/controller/cert-manager-edit-cr.yamlbindata/cert-manager-deployment/controller/cert-manager-leaderelection-rb.yamlbindata/cert-manager-deployment/cainjector/cert-manager-cainjector-svc.yamlpkg/operator/applyconfigurations/utils.goimages/ci/operand.Dockerfilebindata/cert-manager-deployment/webhook/cert-manager-webhook-subjectaccessreviews-crb.yamlbindata/cert-manager-deployment/cert-manager/cert-manager-controller-certificatesigningrequests-crb.yamlconfig/manager/manager.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-ingress-shim-crb.yamlpkg/operator/applyconfigurations/operator/v1alpha1/certmanagerconfig.goDockerfileapi/operator/v1alpha1/zz_generated.deepcopy.gobindata/cert-manager-deployment/cainjector/cert-manager-cainjector-sa.yamlbindata/cert-manager-deployment/webhook/cert-manager-webhook-sa.yamlgo.modbindata/cert-manager-deployment/controller/cert-manager-controller-orders-crb.yamlbundle/manifests/cert-manager.io_certificates.yamlbundle/metadata/annotations.yamlbindata/cert-manager-deployment/cainjector/cert-manager-cainjector-leaderelection-rb.yamlbindata/cert-manager-deployment/cert-manager/cert-manager-controller-approve-cert-manager-io-cr.yamlbindata/cert-manager-deployment/controller/cert-manager-deployment.yamlbindata/cert-manager-deployment/cert-manager/cert-manager-controller-certificatesigningrequests-cr.yamlpkg/controller/istiocsr/deployments_test.gobindata/cert-manager-deployment/controller/cert-manager-controller-certificates-cr.yamlMakefilebindata/cert-manager-deployment/cainjector/cert-manager-cainjector-crb.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-clusterissuers-cr.yamlbindata/cert-manager-deployment/webhook/cert-manager-webhook-dynamic-serving-role.yamlbindata/cert-manager-deployment/controller/cert-manager-sa.yamlpkg/operator/applyconfigurations/operator/v1alpha1/istiocsr.gobindata/cert-manager-deployment/webhook/cert-manager-webhook-mutatingwebhookconfiguration.yamlbindata/cert-manager-deployment/controller/cert-manager-svc.yamlbundle/manifests/acme.cert-manager.io_challenges.yamlconfig/crd/bases/certificaterequests.cert-manager.io-crd.yamlbindata/cert-manager-deployment/cainjector/cert-manager-cainjector-cr.yamlpkg/controller/deployment/cert_manager_controller_deployment.gobindata/cert-manager-deployment/webhook/cert-manager-webhook-deployment.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-challenges-cr.yamlpkg/controller/deployment/deployment_overrides_test.gorebase_automation.shbindata/cert-manager-deployment/cainjector/cert-manager-cainjector-leaderelection-role.yamlbindata/cert-manager-deployment/controller/cert-manager-cluster-view-cr.yamlbindata/cert-manager-deployment/controller/cert-manager-view-cr.yamlbundle/manifests/cert-manager.io_certificaterequests.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-challenges-crb.yamlconfig/crd/bases/issuers.cert-manager.io-crd.yamlconfig/crd/bases/operator.openshift.io_istiocsrs.yamlbundle/manifests/cert-manager.io_issuers.yamlbundle/manifests/operator.openshift.io_istiocsrs.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-issuers-crb.yamlbindata/cert-manager-deployment/webhook/cert-manager-webhook-subjectaccessreviews-cr.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-orders-cr.yamlbindata/cert-manager-deployment/controller/cert-manager-tokenrequest-rb.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-ingress-shim-cr.yamlbindata/cert-manager-deployment/cainjector/cert-manager-cainjector-deployment.yamlconfig/manifests/bases/cert-manager-operator.clusterserviceversion.yamlpkg/operator/applyconfigurations/operator/v1alpha1/certmanager.goconfig/crd/bases/challenges.acme.cert-manager.io-crd.yamlconfig/crd/bases/clusterissuers.cert-manager.io-crd.yamlbundle/manifests/acme.cert-manager.io_orders.yamlbundle/manifests/cert-manager.io_clusterissuers.yamlbundle/manifests/cert-manager-operator.clusterserviceversion.yamlbindata/cert-manager-deployment/controller/cert-manager-tokenrequest-role.yamlconfig/crd/bases/operator.openshift.io_certmanagers.yamlconfig/crd/bases/orders.acme.cert-manager.io-crd.yamlconfig/crd/bases/certificates.cert-manager.io-crd.yamlbundle/manifests/operator.openshift.io_certmanagers.yamlpkg/operator/assets/bindata.gopkg/operator/applyconfigurations/internal/internal.go
🪛 Shellcheck (0.11.0)
rebase_automation.sh
[warning] 14-14: REPO_ROOT appears unused. Verify use (or export if used externally).
(SC2034)
[warning] 143-143: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 197-197: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 198-198: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 272-272: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 273-273: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 280-280: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 281-281: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 315-319: Prefer mapfile or read -a to split command output (or quote to avoid splitting).
(SC2207)
[warning] 335-335: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 407-407: Prefer mapfile or read -a to split command output (or quote to avoid splitting).
(SC2207)
| compute a sum by iterating through the elements of this field and subtracting | ||
| "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the | ||
| node(s) with the highest sum are the most preferred. |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, let's check the file exists and read the specific lines
cd bundle/manifests && ls -la acme.cert-manager.io_challenges.yaml 2>/dev/null || cd ../.. && ls -la bundle/manifests/acme.cert-manager.io_challenges.yamlRepository: openshift/cert-manager-operator
Length of output: 280
🏁 Script executed:
# Read lines around 1435-1437
sed -n '1430,1445p' bundle/manifests/acme.cert-manager.io_challenges.yamlRepository: openshift/cert-manager-operator
Length of output: 1599
🏁 Script executed:
# Read lines around 2738-2740
sed -n '2733,2750p' bundle/manifests/acme.cert-manager.io_challenges.yamlRepository: openshift/cert-manager-operator
Length of output: 1751
🌐 Web query:
Kubernetes WeightedPodAffinityTerm documentation weight calculation subtract or add
💡 Result:
The weight is added (summed) to the node's score — Kubernetes iterates preferred rules a node satisfies and adds each rule's weight to the node's score (it is not subtracted). [1][2]
Sources:
[1] Kubernetes docs — Assigning Pods to Nodes (pod/node affinity weight described).
[2] Kubernetes v1.33 docs — node/pod affinity preferred weight explanation.
Fix contradictory PodAntiAffinity documentation: change "subtracting" to "adding"
The current text states the scheduler computes "a sum by iterating through the elements of this field and subtracting weight from the sum," but then concludes "the node(s) with the highest sum are the most preferred." This is contradictory—subtracting weight would make lower sums preferred. Kubernetes documentation explicitly states that weights are added per-node to find the most preferred node(s), not subtracted.
- compute a sum by iterating through the elements of this field and subtracting
- "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+ compute a sum by iterating through the elements of this field and adding
+ "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; theAlso applies to: 2738-2740
🤖 Prompt for AI Agents
In bundle/manifests/acme.cert-manager.io_challenges.yaml around lines 1435-1437
(and also apply the same change at lines 2738-2740), update the PodAntiAffinity
description to remove the contradiction by replacing the term "subtracting
weight from the sum" with "adding weight to the sum"; ensure the sentence reads
that the scheduler computes a sum by iterating through the elements of this
field and adding the corresponding "weight" when a node has matching pods so
that the node(s) with the highest sum are the most preferred.
| app.kubernetes.io/component: crds | ||
| app.kubernetes.io/instance: cert-manager | ||
| app.kubernetes.io/name: cert-manager | ||
| app.kubernetes.io/version: v1.18.3 | ||
| app.kubernetes.io/version: v1.19.2 |
There was a problem hiding this comment.
Verify app.kubernetes.io/version matches the actual cert-manager operand version
The label is set to v1.19.2, while the PR description talks about rebasing against cert-manager v1.19.1. If the shipped operand (images, Go module replace, etc.) is actually v1.19.1, this label will be misleading for users and tooling that rely on it for debugging and inventory.
Recommend aligning this label with the real operand version (or updating the operand to match the label), and ensuring the same value is used consistently across all cert-manager bundle/CRD manifests.
🤖 Prompt for AI Agents
In bundle/manifests/cert-manager.io_clusterissuers.yaml around lines 10 to 13,
the app.kubernetes.io/version label is set to v1.19.2 but the PR indicates the
operand was rebased to v1.19.1; update this label to match the actual shipped
cert-manager operand version (or update the operand to v1.19.2 if that was
intended) and then ensure the same version string is used consistently across
all cert-manager bundle and CRD manifests in the repo (search and replace
occurrences, and verify container image tags/Go module replaces align with the
chosen version).
| compute a sum by iterating through the elements of this field and subtracting | ||
| "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the | ||
| node(s) with the highest sum are the most preferred. |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, let's read the file to see the exact content at the specified lines
wc -l config/crd/bases/issuers.cert-manager.io-crd.yamlRepository: openshift/cert-manager-operator
Length of output: 129
🏁 Script executed:
# Read lines around 1472-1474 to see the full context
sed -n '1465,1480p' config/crd/bases/issuers.cert-manager.io-crd.yamlRepository: openshift/cert-manager-operator
Length of output: 1864
🏁 Script executed:
# Read lines around 2683-2685 to see the full context
sed -n '2676,2691p' config/crd/bases/issuers.cert-manager.io-crd.yamlRepository: openshift/cert-manager-operator
Length of output: 1864
🌐 Web query:
Kubernetes PodAntiAffinity weight preferredDuringSchedulingIgnoredDuringExecution documentation
💡 Result:
-
What it is: the weight field on a preferredDuringSchedulingIgnoredDuringExecution podAntiAffinity rule gives that rule a numeric importance (soft preference) used by the scheduler when scoring nodes. [1]
-
Semantics: for each node that satisfies the pod’s other scheduling requirements, the scheduler iterates every preferred podAffinity/podAntiAffinity rule that the node satisfies and adds that rule’s weight to the node’s score; nodes with higher total score are preferred. The rule remains "soft" — it can be violated if no node meets the preference. [1][2]
-
Value/range: integer 1–100. [1]
-
Key bits to include in YAML:
- podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution: a list of {weight, podAffinityTerm}
- podAffinityTerm contains labelSelector and topologyKey (topologyKey cannot be empty for pod anti-affinity). Example: weight: 100 with topologyKey: topology.kubernetes.io/zone. [1][2]
Sources: [1] Kubernetes docs — Assigning Pods to Nodes (pod affinity/anti‑affinity and weight). [2] Kubernetes v1.32 docs / examples.
🏁 Script executed:
# Look for upstream cert-manager types or schema
find . -name "*.go" -type f | head -20Repository: openshift/cert-manager-operator
Length of output: 939
🌐 Web query:
cert-manager upstream issuer CRD PodAntiAffinity weight types
💡 Result:
In cert-manager’s upstream Issuer/ClusterIssuer PodAntiAffinity CRD the "weight" field is an integer (int32) in the range 1–100 used on Preferred (preferredDuringSchedulingIgnoredDuringExecution) rules; Required rules (requiredDuringSchedulingIgnoredDuringExecution) do not use a weight. [1][2]
Sources:
[1] cert-manager CRD schema showing podAntiAffinity weight as integer 1–100.
[2] cert-manager/clusterissuer CRD docs listing preferred vs required affinity and weight semantics.
🏁 Script executed:
# Check if there's any indication this file is generated
head -20 config/crd/bases/issuers.cert-manager.io-crd.yamlRepository: openshift/cert-manager-operator
Length of output: 626
🏁 Script executed:
# Let's check the git history or any comments about how this file is maintained
head -100 config/crd/bases/issuers.cert-manager.io-crd.yaml | tail -80Repository: openshift/cert-manager-operator
Length of output: 4260
🏁 Script executed:
# Search for any scripts or docs that manage this CRD file
find . -name "*.md" -o -name "*.sh" | xargs grep -l "issuers.cert-manager.io-crd" 2>/dev/null | head -5Repository: openshift/cert-manager-operator
Length of output: 57
🌐 Web query:
cert-manager 1.19.2 upstream Issuer CRD PodAntiAffinity description subtracting adding
💡 Result:
Short answer: the upstream cert-manager v1.19.x CRDs include an Issuer/ClusterIssuer schema field podAntiAffinity (with the standard Kubernetes podAntiAffinity description and properties). This was present in the generated CRD templates used by the chart/CRD YAML (see the podAntiAffinity description and preferredDuringSchedulingIgnoredDuringExecution text). See the cert-manager releases/docs and the CRD template showing the podAntiAffinity description. [1][2]
Sources:
- cert-manager v1.19 release notes. [1]
- cert-manager CRD template showing podAntiAffinity description/properties (charts/templates/crds.yaml). [2]
🏁 Script executed:
# Let's look at the exact context around both locations to understand the internal contradiction
sed -n '1468,1485p' config/crd/bases/issuers.cert-manager.io-crd.yaml | cat -nRepository: openshift/cert-manager-operator
Length of output: 2146
🏁 Script executed:
# Check the second location as well
sed -n '2679,2696p' config/crd/bases/issuers.cert-manager.io-crd.yaml | cat -nRepository: openshift/cert-manager-operator
Length of output: 2146
🌐 Web query:
cert-manager v1.19.2 upstream source code issuer_types podAntiAffinity weight
💡 Result:
In cert-manager v1.19.2 the Issuer/ClusterIssuer pod template affinity fields reuse Kubernetes' core/v1 PodAffinity/PodAntiAffinity types; the "weight" is the Kubernetes WeightedPodAffinityTerm.weight (an int32 in range 1–100). [1][2]
Sources:
- cert-manager API types (pkg/apis/certmanager/v1) — cert-manager uses k8s PodTemplateSpec/Affinity types. [1]
- Kubernetes core/v1 WeightedPodAffinityTerm: Weight int32 (range 1–100). [2]
🏁 Script executed:
# Let's verify this is indeed generated from upstream by checking for generation markers
grep -i "generated\|autogenerated\|do not edit" config/crd/bases/issuers.cert-manager.io-crd.yaml | head -5Repository: openshift/cert-manager-operator
Length of output: 158
🏁 Script executed:
# Check if there's a script or make target that regenerates this CRD
find . -name "Makefile" -o -name "*.mk" | xargs grep -l "crd\|generate" 2>/dev/null | head -3Repository: openshift/cert-manager-operator
Length of output: 85
🏁 Script executed:
# Check the Makefile for CRD generation targets
cat Makefile | grep -A 10 -B 2 "crd\|generate" | head -60Repository: openshift/cert-manager-operator
Length of output: 3118
🏁 Script executed:
# Look for any documentation about the CRD source
find . -name "*.md" | xargs grep -l "CRD\|crd" 2>/dev/null | head -3Repository: openshift/cert-manager-operator
Length of output: 86
🏁 Script executed:
# Let's check the README for more context about upstream sources
head -50 README.mdRepository: openshift/cert-manager-operator
Length of output: 1895
🏁 Script executed:
# Let's verify the exact Kubernetes upstream documentation behavior with a final check
# Looking at the structure - the main description contradicts the items description
# Let's see both full descriptions in context
sed -n '1450,1500p' config/crd/bases/issuers.cert-manager.io-crd.yaml | grep -A 20 "preferredDuringScheduling"Repository: openshift/cert-manager-operator
Length of output: 2359
PodAntiAffinity weight description uses "subtracting" but should use "adding"
Lines 1472–1474 (and 2683–2685) describe the scheduler as "subtracting 'weight'" when in fact it adds weights to the node score. This contradicts both the Kubernetes upstream documentation and the immediately following description in the same CRD (at the items level) which correctly states "The weights... are added per-node." The scheduler selects the node with the highest sum of added weights, not subtracted ones. Since this file is generated from cert-manager v1.19.2, this error likely originates in the upstream schema and should be fixed there and regenerated rather than hand-edited downstream.
🤖 Prompt for AI Agents
In config/crd/bases/issuers.cert-manager.io-crd.yaml around lines 1472-1474 (and
also 2683-2685), the PodAntiAffinity description incorrectly says the scheduler
"subtracts" the weight when computing node scores; change the wording to state
that the weights are "added" to the per-node sum and that the scheduler selects
the node(s) with the highest total, and then regenerate this CRD from the
corrected cert-manager v1.19.2 schema upstream (or fix the upstream schema and
re-run the CRD generation) so the correction is applied consistently rather than
hand-editing the generated file.
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (2)
config/crd/bases/issuers.cert-manager.io-crd.yaml (1)
1472-1474: PodAntiAffinity weight description still uses “subtracting” instead of “adding”These descriptions say the scheduler subtracts
weightper matched term, but Kubernetes actually adds weights to compute node scores, and the surrounding text already speaks about the “greatest sum of weights.” This is a documentation inconsistency with scheduler behavior and the item-level description just below.Consider aligning both blocks with the wording used for
podAffinity/nodeAffinity(i.e., weights are added to the per-node sum) in the upstream schema or generator, then regenerating this CRD rather than hand-editing the generated YAML.Also applies to: 2683-2685
bundle/manifests/acme.cert-manager.io_challenges.yaml (1)
1427-1437: Fix podAntiAffinity weight description: “subtracting” should be “adding”The description currently says the scheduler computes a sum by subtracting weight, yet concludes that nodes with the highest sum are preferred. In reality, weights are added per matching term; the current text is self‑contradictory.
- compute a sum by iterating through the elements of this field and subtracting - "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; theApply the same change in both occurrences (Line 1435-1437 and Line 2738-2740).
Also applies to: 2730-2740
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (80)
.ci-operator.yaml(1 hunks)Dockerfile(1 hunks)Makefile(2 hunks)api/operator/v1alpha1/zz_generated.deepcopy.go(1 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-cr.yaml(1 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-crb.yaml(1 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-deployment.yaml(3 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-leaderelection-rb.yaml(1 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-leaderelection-role.yaml(1 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-sa.yaml(1 hunks)bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-svc.yaml(1 hunks)bindata/cert-manager-deployment/cert-manager/cert-manager-controller-approve-cert-manager-io-cr.yaml(1 hunks)bindata/cert-manager-deployment/cert-manager/cert-manager-controller-approve-cert-manager-io-crb.yaml(1 hunks)bindata/cert-manager-deployment/cert-manager/cert-manager-controller-certificatesigningrequests-cr.yaml(1 hunks)bindata/cert-manager-deployment/cert-manager/cert-manager-controller-certificatesigningrequests-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-cluster-view-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-certificates-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-certificates-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-challenges-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-challenges-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-clusterissuers-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-clusterissuers-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-ingress-shim-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-ingress-shim-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-issuers-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-issuers-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-orders-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-controller-orders-crb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-deployment.yaml(3 hunks)bindata/cert-manager-deployment/controller/cert-manager-edit-cr.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-leaderelection-rb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-leaderelection-role.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-sa.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-svc.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-tokenrequest-rb.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-tokenrequest-role.yaml(1 hunks)bindata/cert-manager-deployment/controller/cert-manager-view-cr.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-deployment.yaml(3 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-dynamic-serving-rb.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-dynamic-serving-role.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-mutatingwebhookconfiguration.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-sa.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-subjectaccessreviews-cr.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-subjectaccessreviews-crb.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-svc.yaml(1 hunks)bindata/cert-manager-deployment/webhook/cert-manager-webhook-validatingwebhookconfiguration.yaml(1 hunks)bundle.Dockerfile(1 hunks)bundle/manifests/acme.cert-manager.io_challenges.yaml(19 hunks)bundle/manifests/acme.cert-manager.io_orders.yaml(6 hunks)bundle/manifests/cert-manager-operator.clusterserviceversion.yaml(5 hunks)bundle/manifests/cert-manager.io_certificaterequests.yaml(5 hunks)bundle/manifests/cert-manager.io_certificates.yaml(14 hunks)bundle/manifests/cert-manager.io_clusterissuers.yaml(25 hunks)bundle/manifests/cert-manager.io_issuers.yaml(25 hunks)bundle/manifests/operator.openshift.io_certmanagers.yaml(7 hunks)bundle/manifests/operator.openshift.io_istiocsrs.yaml(4 hunks)bundle/metadata/annotations.yaml(1 hunks)config/crd/bases/certificaterequests.cert-manager.io-crd.yaml(5 hunks)config/crd/bases/certificates.cert-manager.io-crd.yaml(14 hunks)config/crd/bases/challenges.acme.cert-manager.io-crd.yaml(19 hunks)config/crd/bases/clusterissuers.cert-manager.io-crd.yaml(25 hunks)config/crd/bases/issuers.cert-manager.io-crd.yaml(25 hunks)config/crd/bases/operator.openshift.io_certmanagers.yaml(7 hunks)config/crd/bases/operator.openshift.io_istiocsrs.yaml(4 hunks)config/crd/bases/orders.acme.cert-manager.io-crd.yaml(6 hunks)config/manager/manager.yaml(1 hunks)config/manifests/bases/cert-manager-operator.clusterserviceversion.yaml(4 hunks)go.mod(11 hunks)images/ci/Dockerfile(1 hunks)images/ci/operand.Dockerfile(1 hunks)pkg/controller/deployment/cert_manager_controller_deployment.go(1 hunks)pkg/controller/deployment/deployment_overrides_test.go(3 hunks)pkg/controller/istiocsr/deployments_test.go(1 hunks)pkg/operator/applyconfigurations/internal/internal.go(1 hunks)pkg/operator/applyconfigurations/operator/v1alpha1/certmanager.go(2 hunks)pkg/operator/applyconfigurations/operator/v1alpha1/certmanagerconfig.go(2 hunks)pkg/operator/applyconfigurations/operator/v1alpha1/istiocsr.go(2 hunks)pkg/operator/applyconfigurations/utils.go(2 hunks)pkg/operator/assets/bindata.go(51 hunks)pkg/operator/clientset/versioned/fake/clientset_generated.go(1 hunks)
✅ Files skipped from review due to trivial changes (1)
- bindata/cert-manager-deployment/cert-manager/cert-manager-controller-approve-cert-manager-io-crb.yaml
🚧 Files skipped from review as they are similar to previous changes (39)
- bindata/cert-manager-deployment/controller/cert-manager-controller-clusterissuers-cr.yaml
- config/manager/manager.yaml
- .ci-operator.yaml
- bindata/cert-manager-deployment/webhook/cert-manager-webhook-validatingwebhookconfiguration.yaml
- bindata/cert-manager-deployment/controller/cert-manager-view-cr.yaml
- bindata/cert-manager-deployment/controller/cert-manager-tokenrequest-rb.yaml
- bundle.Dockerfile
- bindata/cert-manager-deployment/webhook/cert-manager-webhook-mutatingwebhookconfiguration.yaml
- pkg/controller/deployment/cert_manager_controller_deployment.go
- bindata/cert-manager-deployment/controller/cert-manager-controller-issuers-cr.yaml
- bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-crb.yaml
- pkg/controller/istiocsr/deployments_test.go
- bindata/cert-manager-deployment/controller/cert-manager-tokenrequest-role.yaml
- api/operator/v1alpha1/zz_generated.deepcopy.go
- bindata/cert-manager-deployment/controller/cert-manager-controller-challenges-crb.yaml
- bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-sa.yaml
- bindata/cert-manager-deployment/webhook/cert-manager-webhook-dynamic-serving-role.yaml
- bindata/cert-manager-deployment/webhook/cert-manager-webhook-dynamic-serving-rb.yaml
- bindata/cert-manager-deployment/controller/cert-manager-controller-certificates-cr.yaml
- pkg/operator/applyconfigurations/operator/v1alpha1/istiocsr.go
- pkg/operator/applyconfigurations/utils.go
- bindata/cert-manager-deployment/controller/cert-manager-controller-orders-cr.yaml
- images/ci/Dockerfile
- config/crd/bases/operator.openshift.io_istiocsrs.yaml
- bindata/cert-manager-deployment/controller/cert-manager-leaderelection-rb.yaml
- config/crd/bases/certificaterequests.cert-manager.io-crd.yaml
- bindata/cert-manager-deployment/cert-manager/cert-manager-controller-approve-cert-manager-io-cr.yaml
- bindata/cert-manager-deployment/controller/cert-manager-leaderelection-role.yaml
- pkg/operator/applyconfigurations/internal/internal.go
- bindata/cert-manager-deployment/controller/cert-manager-controller-clusterissuers-crb.yaml
- bindata/cert-manager-deployment/webhook/cert-manager-webhook-sa.yaml
- bindata/cert-manager-deployment/webhook/cert-manager-webhook-svc.yaml
- bundle/manifests/cert-manager-operator.clusterserviceversion.yaml
- bindata/cert-manager-deployment/controller/cert-manager-edit-cr.yaml
- pkg/operator/clientset/versioned/fake/clientset_generated.go
- bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-deployment.yaml
- Dockerfile
- config/manifests/bases/cert-manager-operator.clusterserviceversion.yaml
- bindata/cert-manager-deployment/controller/cert-manager-cluster-view-cr.yaml
🧰 Additional context used
📓 Path-based instructions (1)
**
⚙️ CodeRabbit configuration file
-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.
Files:
bindata/cert-manager-deployment/webhook/cert-manager-webhook-subjectaccessreviews-cr.yamlbundle/metadata/annotations.yamlbindata/cert-manager-deployment/controller/cert-manager-deployment.yamlbindata/cert-manager-deployment/cainjector/cert-manager-cainjector-leaderelection-role.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-challenges-cr.yamlbindata/cert-manager-deployment/cainjector/cert-manager-cainjector-leaderelection-rb.yamlbundle/manifests/operator.openshift.io_certmanagers.yamlbindata/cert-manager-deployment/webhook/cert-manager-webhook-subjectaccessreviews-crb.yamlbindata/cert-manager-deployment/cert-manager/cert-manager-controller-certificatesigningrequests-cr.yamlbundle/manifests/cert-manager.io_issuers.yamlpkg/operator/applyconfigurations/operator/v1alpha1/certmanagerconfig.goconfig/crd/bases/certificates.cert-manager.io-crd.yamlbundle/manifests/acme.cert-manager.io_challenges.yamlMakefilebindata/cert-manager-deployment/cert-manager/cert-manager-controller-certificatesigningrequests-crb.yamlimages/ci/operand.Dockerfilebindata/cert-manager-deployment/controller/cert-manager-svc.yamlbundle/manifests/cert-manager.io_clusterissuers.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-certificates-crb.yamlconfig/crd/bases/clusterissuers.cert-manager.io-crd.yamlpkg/controller/deployment/deployment_overrides_test.gobindata/cert-manager-deployment/cainjector/cert-manager-cainjector-cr.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-ingress-shim-cr.yamlbindata/cert-manager-deployment/webhook/cert-manager-webhook-deployment.yamlconfig/crd/bases/operator.openshift.io_certmanagers.yamlgo.modconfig/crd/bases/orders.acme.cert-manager.io-crd.yamlpkg/operator/assets/bindata.goconfig/crd/bases/issuers.cert-manager.io-crd.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-ingress-shim-crb.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-orders-crb.yamlbundle/manifests/cert-manager.io_certificates.yamlbindata/cert-manager-deployment/controller/cert-manager-controller-issuers-crb.yamlbindata/cert-manager-deployment/controller/cert-manager-sa.yamlpkg/operator/applyconfigurations/operator/v1alpha1/certmanager.gobundle/manifests/operator.openshift.io_istiocsrs.yamlbindata/cert-manager-deployment/cainjector/cert-manager-cainjector-svc.yamlbundle/manifests/cert-manager.io_certificaterequests.yamlconfig/crd/bases/challenges.acme.cert-manager.io-crd.yamlbundle/manifests/acme.cert-manager.io_orders.yaml
🔇 Additional comments (73)
bindata/cert-manager-deployment/cert-manager/cert-manager-controller-certificatesigningrequests-crb.yaml (1)
9-9: Version label correctly updated.The version label update to v1.19.2 aligns with the PR objective to upgrade cert-manager.
bindata/cert-manager-deployment/webhook/cert-manager-webhook-subjectaccessreviews-crb.yaml (1)
9-9: LGTM!The version label update to v1.19.2 is correct and consistent with the cert-manager upgrade objective.
pkg/controller/deployment/deployment_overrides_test.go (1)
35-35: LGTM! Version bump correctly applied.The test expectations have been consistently updated to reflect the cert-manager v1.19.2 upgrade. All occurrences of the acme-http01-solver-image version string are correctly updated across default args and test expectations.
Also applies to: 123-123, 175-175
bundle/manifests/operator.openshift.io_certmanagers.yaml (3)
5-5: LGTM!Controller-gen version bump to v0.19.0 aligns with the upstream cert-manager v1.19.2 update.
63-159: LGTM!The
fileKeyRefaddition and env var name description update align with upstream Kubernetes API changes. The schema is properly structured with required fields (key,path,volumeName), sensible defaults (optional: false), and clear documentation noting the alpha EnvFiles feature gate dependency.
344-440: LGTM!The
fileKeyRefand env var name description changes are consistently applied acrosscontrollerConfigandwebhookConfig, matching thecainjectorConfigsection. Good schema consistency.Also applies to: 939-1035
pkg/operator/applyconfigurations/operator/v1alpha1/certmanager.go (1)
67-67: LGTM! Generated methods follow established patterns.The added marker method
IsApplyConfiguration()and getter methods (GetKind,GetAPIVersion,GetNamespace) are correctly implemented:
IsApplyConfiguration()serves as an interface marker (standard pattern)GetKind()andGetAPIVersion()safely access the value-embeddedTypeMetaApplyConfigurationGetNamespace()properly callsensureObjectMetaApplyConfigurationExists()before accessing the pointer field, consistent with the existingGetName()implementationThese are generated additions from the upstream cert-manager v1.19.2 bump with no concerns.
Also applies to: 243-263
pkg/operator/applyconfigurations/operator/v1alpha1/certmanagerconfig.go (1)
12-12: No action needed — WithIssuerRef is not called anywhere in the codebase.The file is correctly generated code. The IssuerRef field type (
v1.IssuerReference) and the WithIssuerRef method are defined properly in the apply configuration, but the method has no actual callers. No call sites require updates because this method is not used.Likely an incorrect or invalid review comment.
config/crd/bases/operator.openshift.io_certmanagers.yaml (3)
6-6: LGTM: Controller-gen version bump.The controller-gen version update from v0.15.0 to v0.19.0 aligns with the upstream cert-manager v1.19.2 upgrade.
708-712: Unable to verify AI summary claims due to lack of git history in the repository. The current protocol field definition (lines 708-712) contains a description stating "If not specified, this field defaults to TCP" but no explicitdefault: TCPproperty is present. Without access to previous commits, the claim that a default value was removed cannot be confirmed. If this change is significant for users upgrading NetworkPolicy resources, it should be documented in release notes regardless of whether an explicit schema default was removed.
63-66: No action required - this uses standard Kubernetes EnvVar validation.The
overrideEnvfield uses Kubernetes' standardcorev1.EnvVartype, and the CRD description is auto-generated from that standard type. The description "May consist of any printable ASCII characters except '='" reflects the standard Kubernetes behavior for environment variable names, not a custom relaxation. The codebase does not implement custom validation; it relies entirely on the upstream Kubernetes API types in v0.34.1. No compatibility concerns exist.bindata/cert-manager-deployment/cert-manager/cert-manager-controller-certificatesigningrequests-cr.yaml (1)
9-9: LGTM!Version label correctly updated to v1.19.2, consistent with the PR's upstream bump objective.
bindata/cert-manager-deployment/webhook/cert-manager-webhook-subjectaccessreviews-cr.yaml (1)
9-9: LGTM!Version label correctly updated to v1.19.2, aligning with the cert-manager upgrade.
bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-leaderelection-role.yaml (1)
9-9: LGTM!Version label correctly updated to v1.19.2 for the cainjector leaderelection Role.
bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-cr.yaml (1)
9-9: LGTM!Version label correctly updated to v1.19.2 for the cainjector ClusterRole.
bindata/cert-manager-deployment/controller/cert-manager-controller-challenges-cr.yaml (1)
9-9: LGTM!Version label correctly updated to v1.19.2 for the controller challenges ClusterRole.
bindata/cert-manager-deployment/controller/cert-manager-controller-orders-crb.yaml (1)
9-9: LGTM!Version label correctly updated to v1.19.2 for the controller orders ClusterRoleBinding.
bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-svc.yaml (1)
9-9: LGTM!Version label correctly updated to v1.19.2 for the cainjector Service, completing the consistent version bump across all reviewed manifests.
images/ci/operand.Dockerfile (1)
1-3: Base image upgrade is properly applied across configuration files.The base builder image has been updated to golang-1.25-openshift-4.21 and is consistently referenced in operand.Dockerfile, images/ci/Dockerfile, and the Makefile. The release branch is correctly set to v1.19.2. However, image availability cannot be verified in this environment and requires manual confirmation that the base image exists in the registry.
bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-leaderelection-rb.yaml (1)
9-9: LGTM! Version label correctly updated.The version label update from v1.18.3 to v1.19.2 aligns with the upstream cert-manager upgrade objective.
bindata/cert-manager-deployment/controller/cert-manager-controller-certificates-crb.yaml (1)
9-9: LGTM! Version label correctly updated.The version label update to v1.19.2 is consistent with the cert-manager upgrade.
bindata/cert-manager-deployment/controller/cert-manager-sa.yaml (1)
10-10: LGTM! Version label correctly updated.The ServiceAccount version label update aligns with the v1.19.2 upgrade.
bindata/cert-manager-deployment/controller/cert-manager-svc.yaml (1)
9-9: LGTM! Version label correctly updated.The Service version label update is consistent with the cert-manager v1.19.2 upgrade.
bindata/cert-manager-deployment/controller/cert-manager-controller-ingress-shim-cr.yaml (1)
9-9: LGTM! Version label correctly updated.The ClusterRole version label update aligns with the v1.19.2 upgrade.
bindata/cert-manager-deployment/webhook/cert-manager-webhook-deployment.yaml (1)
9-9: LGTM! Version labels and image tag correctly updated.The webhook deployment version labels and container image tag are consistently updated to v1.19.2, aligning with the cert-manager upgrade.
Also applies to: 30-30, 46-46
bundle/metadata/annotations.yaml (1)
7-7: LGTM! Bundle channel correctly updated.The channel update from stable-v1.18 to stable-v1.19 correctly reflects the version series upgrade to v1.19.x.
bindata/cert-manager-deployment/controller/cert-manager-controller-ingress-shim-crb.yaml (1)
9-9: LGTM! Version label correctly updated.The ClusterRoleBinding version label update to v1.19.2 is consistent with the cert-manager upgrade.
bindata/cert-manager-deployment/controller/cert-manager-controller-issuers-crb.yaml (1)
9-9: LGTM!Version label correctly updated to v1.19.2, consistent with the upstream cert-manager version bump.
bindata/cert-manager-deployment/controller/cert-manager-deployment.yaml (1)
9-9: LGTM!All version labels and image tags are consistently updated to v1.19.2:
- Metadata and pod template labels (lines 9, 30)
- ACME HTTP01 solver image argument (line 37)
- Controller container image (line 47)
Also applies to: 30-30, 37-37, 47-47
bundle/manifests/cert-manager.io_certificates.yaml (3)
10-13: LGTM!Added
crdscomponent label and version bump to v1.19.2 aligns with the upstream cert-manager release.
104-104: LGTM!The
x-kubernetes-list-type: atomicannotations are correctly applied to list fields. This ensures proper Server-Side Apply (SSA) semantics where these lists are replaced entirely rather than merged, which is appropriate for certificate configuration arrays likeadditionalOutputFormats,dnsNames,emailAddresses, andipAddresses.Also applies to: 120-120, 136-136, 149-149
170-181: LGTM!The
issuerReffield descriptions now explicitly document the default values forgroup(cert-manager.io) andkind(Issuer). This improves API discoverability without changing behavior.Makefile (3)
6-7: LGTM!Version variables correctly updated:
BUNDLE_VERSIONto 1.19.0 (operator bundle version)CERT_MANAGER_VERSIONto v1.19.2 (upstream cert-manager operand version)The distinction between bundle version (1.19.0) and operand version (v1.19.2) is appropriate for operator lifecycle management.
15-15: LGTM!Channel configuration properly updated for v1.19 release:
CHANNELSupdated to includestable-v1.19DEFAULT_CHANNELset tostable-v1for OLM default channel handlingBUNDLE_METADATA_OPTScorrectly includes both channel flagsAlso applies to: 25-29
89-89: LGTM!Container image updated to
rhel-9-golang-1.25-openshift-4.21, aligning with the Go 1.25 toolchain requirement for cert-manager v1.19.2 and targeting OpenShift 4.21.config/crd/bases/orders.acme.cert-manager.io-crd.yaml (3)
12-12: LGTM!Version label correctly updated to v1.19.2, consistent with other CRD manifests.
80-80: LGTM!
x-kubernetes-list-type: atomiccorrectly applied to ACME Order arrays (dnsNames,ipAddresses,challenges,authorizations). These fields should be replaced atomically during updates rather than merged.Also applies to: 94-94, 184-184, 222-222
104-115: LGTM!The
issuerReffield descriptions are updated consistently with other CRDs, documenting default values forgroupandkindfields.bundle/manifests/cert-manager.io_issuers.yaml (5)
13-13: Version label and printer columns look consistent with the v1.19.2 bump
app.kubernetes.io/versionand the Ready/Status jsonPath expressions are updated in a purely cosmetic, upstream-aligned way; no behavioral change or risk here.Also applies to: 29-32
543-550: RFC2136protocolenum is backward compatible and well-scopedAdding the optional
protocolfield with enum{TCP, UDP}under the RFC2136 DNS01 solver is schema-correct and keeps existing manifests valid since the field isn’t required; the default behavior can continue to be implied by the controller.
644-644: Newx-kubernetes-*list/map markers align with structural schema best practicesMarking these arrays (audiences, parentRefs, imagePullSecrets, supplementalGroups, sysctls, tolerations, dnsNames/dnsZones, CA/selfSigned/Vault lists) as
atomicormapwithx-kubernetes-list-map-keysmatches Kubernetes structural schema guidance and should improve merge behavior without changing semantics.Also applies to: 923-924, 1949-1951, 2117-2117, 2140-2140, 2185-2185, 3276-3278, 3444-3444, 3467-3467, 3512-3512, 3542-3542, 3557-3557, 3568-3568, 3587-3587, 3596-3596, 3607-3607, 3629-3629, 3758-3758
1566-1568: Pod anti-affinity weight wording change is documentation-onlyThe updated description about “subtracting weight” for preferred anti-affinity terms is confined to comments, keeps the schema unchanged, and is consistent across both podAntiAffinity blocks; nothing to adjust from an operator perspective.
Also applies to: 2893-2895
1963-1996: ACME HTTP01 solverresourcesoverrides are modeled correctlyThe new
resourcesobjects for HTTP01 solver pod templates use the standard resource.Quantity pattern andx-kubernetes-int-or-stringsemantics for limits/requests, are optional, and don’t introduce new required fields—this is a safe, backwards-compatible enhancement.Also applies to: 3290-3323
bundle/manifests/cert-manager.io_certificaterequests.yaml (4)
10-13: LGTM! Version bump and metadata update are correct.The version update to v1.19.2 and the addition of the
app.kubernetes.io/component: crdslabel align with upstream cert-manager v1.19.2 and follow standard Kubernetes labeling conventions.
30-45: LGTM! JSONPath formatting improvements are consistent.The spacing around the equality operator in JSONPath expressions improves readability and follows standard formatting conventions. These changes are valid and consistent across all printer columns.
136-147: LGTM! Improved issuerRef field documentation.The updated descriptions for
issuerReffields clarify the default values (group defaults to 'cert-manager.io', kind defaults to 'Issuer'), which improves API documentation and user understanding.
236-236: LGTM! Appropriate list type annotation.The
x-kubernetes-list-type: atomicannotation is correct for the usages field, which contains key usage enums. This ensures proper merge behavior where the entire list is treated as a single atomic unit.bundle/manifests/acme.cert-manager.io_orders.yaml (4)
13-13: LGTM! Version bump is consistent.The version update to v1.19.2 matches the PR objective and is consistent with other CRD manifests in this upgrade.
84-98: LGTM! Appropriate list type annotations for spec fields.The
x-kubernetes-list-type: atomicannotations fordnsNamesandipAddressesare correct. These fields should be treated as atomic units during updates, which is appropriate for DNS name and IP address lists.
108-119: LGTM! Consistent issuerRef documentation improvements.The issuerRef field descriptions match the improvements in the certificaterequests CRD, providing clear default values and improving API documentation consistency across all cert-manager CRDs.
188-228: LGTM! Appropriate list type annotations for status fields.The
x-kubernetes-list-type: atomicannotations forauthorizationsand nestedchallengesarrays are correct. These status fields contain ACME server responses and should be treated atomically, which aligns with their usage pattern where the controller replaces the entire list during reconciliation.config/crd/bases/issuers.cert-manager.io-crd.yaml (3)
12-12: Version label and printer column JSONPath updates are fineLabel bump to
v1.19.2and JSONPath spacing changes are metadata-only and keep behavior unchanged; no issues.Also applies to: 28-31
526-531: RFC2136protocolfield addition looks correctOptional
protocolenum (TCP/UDP) underrfc2136.nameserveris well-scoped, non-breaking (not required), and matches the described behavior; schema is consistent.
623-623: CRD list semantics and solver pod resource overrides align with Kubernetes schema best practicesThe added
x-kubernetes-list-type/x-kubernetes-list-map-keysmarkers for lists (audiences, parentRefs, imagePullSecrets, tolerations, string arrays, etc.) plus the newresourcesoverrides for HTTP01 solver pods and related issuer fields improve structural schema fidelity and patch/apply behavior, and appear consistent and non-breaking across the CRD.Also applies to: 900-900, 1822-1869, 1985-1985, 2005-2005, 2049-2049, 3033-3035, 3047-3080, 3196-3196, 3216-3216, 3260-3260, 3290-3290, 3305-3305, 3316-3316, 3335-3335, 3344-3344, 3355-3355, 3377-3377, 3505-3505
bundle/manifests/acme.cert-manager.io_challenges.yaml (1)
10-13: CRD schema, list markers, and resource fields look consistent with upstream and safeThe added labels, issuerRef description tweaks, new RFC2136
protocolfield, list/map metadata (x-kubernetes-*), and HTTP01 solver pod templateresourcesblocks are structurally sound and improve clarity and merge semantics without changing controller behavior. No issues from an operator/CRD perspective.Also applies to: 81-105, 415-468, 647-2049, 2137-3357, 3367-3395
go.mod (1)
3-352: Toolchain and dependency bumps look coherent; rely on CI/e2e to catch regressionsThe Go version bump and broad upgrade of cert-manager, Kubernetes, controller-runtime/tools, AWS SDK, OTel, and related libraries, plus the
cert-manager→jetstack-cert-manager v1.19.2replace, form a consistent stack and align with the stated upgrade to cert-manager v1.19.2. I don't see any obviously mismatched module versions or suspect replaces here; the graph looks internally consistent for a rebase of this scope.Given the size of the change surface, please rely on CI and targeted e2e runs (especially AWS, Gateway API, and CRD-heavy paths) to validate runtime compatibility and uncover any subtle behavior changes introduced by upstream dependencies.
Also applies to: 354-355
bundle/manifests/cert-manager.io_clusterissuers.yaml (7)
8-13: Metadata labels and version bump look consistent
app.kubernetes.io/component: crdsandapp.kubernetes.io/version: v1.19.2align with this being the CRD bundle for the v1.19.2 cert-manager operand; no concerns here. Just keep this version label consistent with other cert-manager CRDs/bundle manifests in the repo.
28-35: Ready/Status printer columns JSONPath remains correctThe
additionalPrinterColumnsJSONPath expressions forReadyandStatusstill correctly select the Ready condition’sstatusandmessage. The minor formatting change is harmless and keeps kubectl output stable.
537-551: RFC2136 DNS01protocolfield is well-scopedThe new
spec.acme.solvers[].dns01.rfc2136.protocolfield is constrained toTCP/UDPand clearly documentsUDPas the default when unset. This matches the expected RFC2136 usage pattern and doesn’t introduce schema or validation risks.
645-647: x-kubernetes list metadata additions improve SSA/merge semanticsThe added
x-kubernetes-list-type: atomic(here forserviceAccountRef.audiences) and similarx-kubernetes-list-type/x-kubernetes-list-map-keysannotations throughout the schema bring these CRD fields in line with core Kubernetes API conventions, improving server-side apply and patch behavior without changing stored data.
1932-1952: HTTP01 solver podTemplate: imagePullSecrets + resources extensions look correct
- Switching
imagePullSecretsto amaplist keyed byname(withx-kubernetes-list-map-keys/x-kubernetes-list-type: map) matches core PodSpec behavior and gives better patch semantics.- The new
podTemplate.spec.resourcesblock for HTTP01 solver pods uses the standardresource.Quantityschema (x-kubernetes-int-or-stringwith the usual quantity regex) and cleanly documents interaction with global controller flags.These changes are consistent with upstream cert-manager and should be safe for existing manifests.
Also applies to: 1964-1997, 3259-3279, 3291-3324
2106-2142: PodSecurityContext list fields marked atomic are aligned with core APIMarking
supplementalGroupsandsysctlsasx-kubernetes-list-type: atomicfor the solver podsecurityContextmatches how these lists behave in core PodSecurityContext, preventing surprising merge behavior. No issues from a validation or security perspective.Also applies to: 3433-3468
3531-3570: Selector and issuer list fields now explicitly atomic—matches intentThe additions of
x-kubernetes-list-type: atomicfor:
selector.dnsNamesandselector.dnsZones,- the top-level
acme.solverslist,- CA/self-signed
crlDistributionPoints/issuingCertificateURLs/ocspServers,- Vault
serviceAccountRef.audiences,all reflect these as flat lists of scalar values where full replacement on patch is expected. That aligns with how these fields are typically used and shouldn’t affect existing consumers.
Also applies to: 3580-3631, 3752-3760
config/crd/bases/certificates.cert-manager.io-crd.yaml (1)
9-12: CRD label, printer column, and list-type updates align with upstream cert-manager schemaThe label/version bump, jsonPath spacing tweak, issuerRef description clarification, and the added
x-kubernetes-list-type: atomicannotations on the various arrays all look consistent with the v1.19.2 cert-manager CRDs and should not change behavior beyond improving structural schema semantics for SSA and validation.Please just confirm this CRD was regenerated from upstream (e.g., via the usual
controller-gen/makeflow) rather than hand-edited, so it stays in lockstep with the source API.Also applies to: 29-40, 100-133, 141-146, 156-180, 331-387, 389-411, 571-595, 610-623, 624-688
pkg/operator/assets/bindata.go (1)
34-35: Generated bindata changes and new cert-manager-tokenrequest RB asset are internally consistent
- All the
app.kubernetes.io/version: v1.19.2label bumps and the controller/cainjector/webhook image updates toquay.io/jetstack/*:v1.19.2are coherent across assets.- The new
cert-manager-tokenrequest-rb.yamlRoleBinding asset, its byte var, helper functions,_bindatamap entry, and_bintreenode all use the same path (cert-manager-deployment/controller/cert-manager-tokenrequest-rb.yaml) and correctly bind thecert-manager-tokenrequestRole to thecert-managerServiceAccount in thecert-managernamespace.- I don’t see any leftover references to the old tokenrequest RB asset name in this file.
Since this file is generated by go-bindata, please confirm it was fully regenerated from the updated YAML sources (rather than edited by hand) so future updates don’t accidentally overwrite these changes.
Also applies to: 119-128, 203-212, 238-268, 280-281, 467-476, 504-513, 539-548, 656-665, 693-702, 778-787, 813-822, 969-978, 1031-1040, 1066-1075, 1151-1160, 1186-1195, 1283-1292, 1365-1374, 1400-1430, 1446-1447, 1497-1506, 1556-1565, 1592-1601, 1637-1647, 1666-1675, 1705-1739, 1741-1750, 1938-1947, 1974-1983, 2020-2031, 2071-2081, 2100-2109, 2134-2143, 2169-2178, 2212-2223, 3158-3159, 3235-3275
bundle/manifests/operator.openshift.io_istiocsrs.yaml (1)
5-5: IstioCSR CRD description/controller-gen updates are doc-only and safeThe controller-gen version annotation bump, the refined pod (anti)affinity weighting text, the DynamicResourceAllocation note on
resources.claims, and the clarifiedcertManager.issuerRefgroup/kind/name descriptions are all documentation/metadata-only; schema, validation rules, and defaults remain unchanged, so existing IstioCSR resources won’t be affected.Please confirm this CRD was regenerated with the updated controller-gen / API definitions rather than edited manually, to keep it aligned with upstream.
Also applies to: 294-305, 652-662, 1015-1027, 1237-1243
config/crd/bases/challenges.acme.cert-manager.io-crd.yaml (6)
9-12: Metadata labels/version bump LGTM
app.kubernetes.io/component: crdsandapp.kubernetes.io/version: v1.19.2are consistent with the operand upgrade and CRD role; nothing else needed here.
84-96: issuerRef description updates match Issuer defaultsClarified descriptions for
issuerRef.group,issuerRef.kind, andissuerRef.nameaccurately describe the issuer context and documented defaults, without changing the schema itself.
414-419: New RFC2136protocolfield is a safe extensionAdding optional
protocolwith enumTCP/UDP(default via controller behavior) keepsnameserveras the only required property, so existing RFC2136 configurations remain valid while allowing more explicit transport selection.
1710-1712: PodTemplateimagePullSecrets+resourcesschema look correctUsing
x-kubernetes-list-type: mapwithx-kubernetes-list-map-keys: [name]forimagePullSecretsand introducing aresourcesobject shaped like coreResourceRequirementsare both consistent with Kubernetes API patterns and provide predictable merge behavior for solver pods.Also applies to: 1724-1757, 2921-2923, 2935-2968
511-511:x-kubernetes-list-typeannotations are appropriateMarking these arrays (audiences, parentRefs, supplementalGroups, sysctls, tolerations, and selector DNS lists) as
atomicor map-based provides explicit structural metadata and aligns with expected server-side apply/patch semantics without altering existing valid objects.Also applies to: 789-789, 1873-1873, 1893-1893, 1937-1937, 3084-3084, 3104-3104, 3148-3148, 3178-3178, 3193-3193
1360-1362: PodAntiAffinity weight description change is documentation-onlyThe updated explanation about subtracting
weightin preferred anti-affinity terms corrects the textual behavior description while leaving the schema unchanged, so there’s no impact on validation or stored CRs.Also applies to: 2571-2573
config/crd/bases/clusterissuers.cert-manager.io-crd.yaml (1)
9-12: CRD schema bump (labels, RFC2136 protocol, solver resources, list/map markers) looks consistent with upstream
- Label and
app.kubernetes.io/versionchanges align with the v1.19.2 bump.- New
spec.acme.dns01.rfc2136.nameserver.protocolstring enum (TCP/UDP) is additive and keeps existing CRs valid; description matches expected behavior.- Added
podTemplate.spec.resourcesblocks for HTTP01 solvers (gateway and ingress) use the standard resource quantity schema and are also additive.- The various new
x-kubernetes-list-type/x-kubernetes-list-map-keysannotations on lists (imagePullSecrets, audiences, dnsNames/dnsZones, CRL/OCSP lists, etc.) follow Kubernetes structural schema and SSA best practices and should only improve patch/merge semantics rather than change meaning.From what’s shown here, I don’t see any breaking or security-impacting changes; keeping this file generated and in lockstep with the upstream cert-manager v1.19.2 types is the right approach. Please just ensure all other CRD copies/bundles (e.g., under
bundle/manifests) were regenerated from the same upstream revision and that CI/CRD validation passes with these enums and annotations.Also applies to: 28-31, 528-532, 1823-1825, 1838-1870, 3035-3037, 3049-3081, 3291-3292, 3306-3307, 3334-3337, 3338-3345, 3347-3356, 3376-3378, 3504-3507
| fileKeyRef: | ||
| description: |- | ||
| FileKeyRef selects a key of the env file. | ||
| Requires the EnvFiles feature gate to be enabled. | ||
| properties: | ||
| key: | ||
| description: |- | ||
| The key within the env file. An invalid key will prevent the pod from starting. | ||
| The keys defined within a source may consist of any printable ASCII characters except '='. | ||
| During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. | ||
| type: string | ||
| optional: | ||
| default: false | ||
| description: |- | ||
| Specify whether the file or its key must be defined. If the file or key | ||
| does not exist, then the env var is not published. | ||
| If optional is set to true and the specified key does not exist, | ||
| the environment variable will not be set in the Pod's containers. | ||
| If optional is set to false and the specified key does not exist, | ||
| an error will be returned during Pod creation. | ||
| type: boolean | ||
| path: | ||
| description: |- | ||
| The path within the volume from which to select the file. | ||
| Must be relative and may not contain the '..' path or start with '..'. | ||
| type: string | ||
| volumeName: | ||
| description: The name of the volume mount containing | ||
| the env file. | ||
| type: string | ||
| required: | ||
| - key | ||
| - path | ||
| - volumeName | ||
| type: object | ||
| x-kubernetes-map-type: atomic |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, let's understand the repository structure
git ls-files | head -20Repository: openshift/cert-manager-operator
Length of output: 565
🏁 Script executed:
# Check for go.mod to find Kubernetes version
cat go.mod | grep -i 'k8s.io' | head -10Repository: openshift/cert-manager-operator
Length of output: 392
🏁 Script executed:
# Search for any documentation about EnvFiles or feature gates
find . -type f \( -name "*.md" -o -name "*.txt" -o -name "*.adoc" \) | xargs grep -l -i 'envfiles\|feature.gate' 2>/dev/null | head -10Repository: openshift/cert-manager-operator
Length of output: 57
🏁 Script executed:
# Check operator code for feature gate handling and fileKeyRef references
rg -n 'fileKeyRef|EnvFiles' --type go --type yaml | head -20Repository: openshift/cert-manager-operator
Length of output: 2676
🏁 Script executed:
# Look at the OpenShift/K8s version in the repo
rg -n 'openshift.io|kubernetes.io' go.mod | head -10Repository: openshift/cert-manager-operator
Length of output: 57
🌐 Web query:
EnvFiles Kubernetes feature gate status 2024 2025 stable alpha beta
💡 Result:
Summary — EnvFiles feature-gate
- 2024: Not present in mainline Kubernetes (no EnvFiles gate listed). [1]
- 2025: Introduced as an Alpha feature (EnvFiles, default=false) in the v1.34 cycle and documented on the Kubernetes feature-gates page and v1.34 blog. [2][3]
- Later in 2025 (v1.35 beta snapshot): promoted to Beta and enabled by default (announcement in the v1.35 beta notes). [4]
Sources
- Kubernetes Feature Gates reference (shows EnvFiles = Alpha / default=false). [1]
- Kubernetes v1.34 release/blog announcing EnvFiles (alpha) and feature details. [2]
- Kubernetes v1.34 release notes / blog (release context). [3]
- v1.35 beta announcement noting EnvFiles promoted to Beta and enabled by default. [4]
🏁 Script executed:
# Check for README and installation documentation
find . -type f \( -name "README*" -o -name "INSTALL*" -o -name "*.md" \) | head -20Repository: openshift/cert-manager-operator
Length of output: 156
🏁 Script executed:
# Check if there are any operator webhook or validation handlers for feature gates
rg -n 'webhook|validation|mutate|validate' --type go api/ | head -15Repository: openshift/cert-manager-operator
Length of output: 1330
🏁 Script executed:
# Look for any documentation about prerequisites or feature gates
cat README.md 2>/dev/null | head -100Repository: openshift/cert-manager-operator
Length of output: 4113
🏁 Script executed:
# Check for any OpenShift or Kubernetes version requirements documented in the repo
rg -n 'openshift.*version|kubernetes.*version|4\.21|4\.22|1\.34|1\.35' --type md --type txt | head -15Repository: openshift/cert-manager-operator
Length of output: 57
Add operator-level validation or documentation for EnvFiles feature gate requirement.
The new fileKeyRef field requires the alpha EnvFiles feature gate to be enabled in Kubernetes 1.34 (where it defaults to disabled). While the CRD field descriptions already state this requirement, users may not discover it until pod creation fails at runtime.
Address this by either:
- Adding operator-level validation/warnings when pods attempt to use
fileKeyRefwithout the feature gate enabled - Documenting the requirement explicitly in user-facing documentation (README or installation guide)
This becomes less critical in Kubernetes 1.35+ where EnvFiles is promoted to Beta and enabled by default, but remains a risk for 1.34 deployments.
🤖 Prompt for AI Agents
In config/crd/bases/operator.openshift.io_certmanagers.yaml around lines 123 to
159, the new fileKeyRef field depends on the alpha EnvFiles feature gate in
Kubernetes 1.34 which is disabled by default; add operator-level validation or
documentation to prevent runtime failures: implement an operator startup or
admission check that detects CRs using fileKeyRef and emits a clear validation
error or warning when running on a cluster where the EnvFiles feature gate is
not enabled, or alternatively update the repository README/installation guide
and CRD description to prominently document the EnvFiles feature gate
requirement for Kubernetes 1.34 (include exact kube version and remediation
steps to enable the gate), ensuring users are informed before pod creation.
| app.kubernetes.io/version: v1.18.3 | ||
| name: cert-manager-cert-manager-tokenrequest | ||
| app.kubernetes.io/version: v1.19.2 | ||
| name: cert-manager-tokenrequest |
There was a problem hiding this comment.
Not directly related to the changes. But how do we manage the renamed resource in upgraded clusters.
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bharath-b-rh, PillaiManish The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
|
New changes are detected. LGTM label has been removed. |
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting
📒 Files selected for processing (2)
bundle/manifests/cert-manager-operator.clusterserviceversion.yaml(5 hunks)config/manifests/bases/cert-manager-operator.clusterserviceversion.yaml(4 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
**
⚙️ CodeRabbit configuration file
-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.
Files:
config/manifests/bases/cert-manager-operator.clusterserviceversion.yamlbundle/manifests/cert-manager-operator.clusterserviceversion.yaml
🔇 Additional comments (8)
bundle/manifests/cert-manager-operator.clusterserviceversion.yaml (6)
253-253: LGTM!The skipRange is correctly set to allow upgrades from 1.18.x versions to this 1.19.0 release.
274-274: LGTM!Metadata name correctly updated to reflect version 1.19.0.
701-715: LGTM!All environment variables are consistently updated:
- cert-manager components to v1.19.2
- Operator version to 1.19.0
- IstioCSR appropriately remains at v0.14.2
813-813: LGTM!The minKubeVersion has been appropriately updated to 1.31.0 as per previous review feedback.
817-826: LGTM!Related images are consistently updated to v1.19.2 for all cert-manager components and correctly aligned with the environment variables defined earlier in the manifest.
827-828: LGTM!The version field (1.19.0) and replaces field (cert-manager-operator.v1.18.0) correctly define the upgrade path from the previous release.
config/manifests/bases/cert-manager-operator.clusterserviceversion.yaml (2)
21-21: LGTM!The OLM version metadata updates are internally consistent and follow the correct upgrade pattern from v1.18.0 to v1.19.0.
Also applies to: 41-41, 152-153
149-149: The minKubeVersion change from 1.27.0 to 1.31.0 is correct. cert-manager v1.19.2 requires Kubernetes v1.31 or newer (supported range: v1.31 → v1.34), and this aligns with OpenShift 4.21 (Kubernetes 1.34) and 4.22 (Kubernetes 1.35) as mentioned in the PR comments.
| version: v1 | ||
| description: | | ||
| The cert-manager Operator for Red Hat OpenShift provides seamless support for [cert-manager v1.18.3](https://github.com/cert-manager/cert-manager/tree/v1.18.3), which automates certificate management. | ||
| The cert-manager Operator for Red Hat OpenShift provides seamless support for [cert-manager v1.19.2](https://github.com/cert-manager/cert-manager/tree/v1.18.3), which automates certificate management. |
There was a problem hiding this comment.
Fix the stale documentation URL.
The description text references cert-manager v1.19.2, but the URL still points to v1.18.3. This will mislead users to outdated documentation.
🔎 Proposed fix
- The cert-manager Operator for Red Hat OpenShift provides seamless support for [cert-manager v1.19.2](https://github.com/cert-manager/cert-manager/tree/v1.18.3), which automates certificate management.
+ The cert-manager Operator for Red Hat OpenShift provides seamless support for [cert-manager v1.19.2](https://github.com/cert-manager/cert-manager/tree/v1.19.2), which automates certificate management.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| The cert-manager Operator for Red Hat OpenShift provides seamless support for [cert-manager v1.19.2](https://github.com/cert-manager/cert-manager/tree/v1.18.3), which automates certificate management. | |
| The cert-manager Operator for Red Hat OpenShift provides seamless support for [cert-manager v1.19.2](https://github.com/cert-manager/cert-manager/tree/v1.19.2), which automates certificate management. |
🤖 Prompt for AI Agents
In bundle/manifests/cert-manager-operator.clusterserviceversion.yaml around line
348, the description references cert-manager v1.19.2 but the URL points to
v1.18.3; update the URL to the matching v1.19.2 release
(https://github.com/cert-manager/cert-manager/tree/v1.19.2) so the documentation
link matches the cited version and doesn't mislead users.
| version: v1alpha1 | ||
| description: | | ||
| The cert-manager Operator for Red Hat OpenShift provides seamless support for [cert-manager v1.18.3](https://github.com/cert-manager/cert-manager/tree/v1.18.3), which automates certificate management. | ||
| The cert-manager Operator for Red Hat OpenShift provides seamless support for [cert-manager v1.19.2](https://github.com/cert-manager/cert-manager/tree/v1.18.3), which automates certificate management. |
There was a problem hiding this comment.
Fix the inconsistent version reference in the GitHub URL.
The description text references "cert-manager v1.19.2", but the GitHub URL still points to the old version "v1.18.3". This inconsistency will mislead users to outdated documentation.
🔎 Proposed fix
- The cert-manager Operator for Red Hat OpenShift provides seamless support for [cert-manager v1.19.2](https://github.com/cert-manager/cert-manager/tree/v1.18.3), which automates certificate management.
+ The cert-manager Operator for Red Hat OpenShift provides seamless support for [cert-manager v1.19.2](https://github.com/cert-manager/cert-manager/tree/v1.19.2), which automates certificate management.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| The cert-manager Operator for Red Hat OpenShift provides seamless support for [cert-manager v1.19.2](https://github.com/cert-manager/cert-manager/tree/v1.18.3), which automates certificate management. | |
| The cert-manager Operator for Red Hat OpenShift provides seamless support for [cert-manager v1.19.2](https://github.com/cert-manager/cert-manager/tree/v1.19.2), which automates certificate management. |
🤖 Prompt for AI Agents
In config/manifests/bases/cert-manager-operator.clusterserviceversion.yaml
around line 115, the description text claims "cert-manager v1.19.2" but the
GitHub URL points to "v1.18.3"; update the URL to reference the matching tag
v1.19.2 (i.e., change the GitHub link suffix from v1.18.3 to v1.19.2) so the
version in the link and the description are consistent.
|
@PillaiManish: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
There was a problem hiding this comment.
It would be great if we could add one more line to each commit message explaining the context for the change, just for future reference. Especially for
- abb105b (The reason you've already explained in the PR description, it's good to include same as part of the commit)
- b2a5388 (It would be clearer to mention exactly which packages are being bumped and which
latestis being referred to, but I think it should be a specific tag not the driftinglatest?) - 179c4a6 (The context would be lost in a review comment)
| version: v1alpha1 | ||
| description: | | ||
| The cert-manager Operator for Red Hat OpenShift provides seamless support for [cert-manager v1.18.3](https://github.com/cert-manager/cert-manager/tree/v1.18.3), which automates certificate management. | ||
| The cert-manager Operator for Red Hat OpenShift provides seamless support for [cert-manager v1.19.2](https://github.com/cert-manager/cert-manager/tree/v1.18.3), which automates certificate management. |
There was a problem hiding this comment.
| The cert-manager Operator for Red Hat OpenShift provides seamless support for [cert-manager v1.19.2](https://github.com/cert-manager/cert-manager/tree/v1.18.3), which automates certificate management. | |
| The cert-manager Operator for Red Hat OpenShift provides seamless support for [cert-manager v1.19.2](https://github.com/cert-manager/cert-manager/tree/v1.19.2), which automates certificate management. |
5 participants
Rebase downstream cert-manager-operator for v1.19.0 with upstream cert-manager v1.19.2.
Prerequisite: Downstream v1.19.2 tag is pushed and synced https://github.com/openshift/jetstack-cert-manager/tags
Remove
Since
github.com/openshift/kubernetes-sigs-controller-toolsis not being maintained in the downstream.All the following below steps were done with the help of automation script: #309