OCPBUGS-99014: Authenticate Konnectivity agents with cluster CA by hlipsig · Pull Request #9031 · openshift/hypershift

hlipsig · 2026-07-17T01:49:46Z

What this PR does / why we need it:

The Konnectivity proxy-server currently accepts agent connections without validating client certificates because its agent listener is not configured with a cluster CA. A reachable client can therefore connect without a certificate signed by the hosted cluster's Konnectivity CA.

Configure --cluster-ca-cert with the existing mounted Konnectivity CA bundle. Legitimate agents already use certificates signed by this CA. Add a regression test that verifies the embedded kube-apiserver manifest retains the authentication setting.

Which issue(s) this PR fixes:

OCPBUGS-99014

Special notes for your reviewer:

Focused tests passed:
GO111MODULE=on GOWORK=off GOFLAGS=-mod=vendor go test -race ./control-plane-operator/controllers/hostedcontrolplane/v2/assets ./control-plane-operator/controllers/hostedcontrolplane/v2/kas

Checklist:

Subject and description added to both, commit and PR.
Relevant issues have been referenced.
This change includes docs.
This change includes unit tests.

Summary by CodeRabbit

Bug Fixes
- Updated the Konnectivity server configuration to authenticate agents using the cluster CA certificate.
- Ensured the kube-apiserver deployment passes the --cluster-ca-cert argument pointing to the mounted Konnectivity CA file.
Tests
- Added a unit test that verifies the Konnectivity server container exists in the kube-apiserver manifest and includes the correct --cluster-ca-cert setting.

openshift-merge-bot · 2026-07-17T01:49:48Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-07-17T01:49:49Z

@hlipsig: This pull request explicitly references no jira issue.

Details

In response to this:

What this PR does / why we need it:

The Konnectivity proxy-server currently accepts agent connections without validating client certificates because its agent listener is not configured with a cluster CA. A reachable client can therefore connect without a certificate signed by the hosted cluster's Konnectivity CA.

Configure --cluster-ca-cert with the existing mounted Konnectivity CA bundle. Legitimate agents already use certificates signed by this CA. Add a regression test that verifies the embedded kube-apiserver manifest retains the authentication setting.

Which issue(s) this PR fixes:

NO-JIRA

Special notes for your reviewer:

Focused tests passed:
GO111MODULE=on GOWORK=off GOFLAGS=-mod=vendor go test -race ./control-plane-operator/controllers/hostedcontrolplane/v2/assets ./control-plane-operator/controllers/hostedcontrolplane/v2/kas

Checklist:

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-07-17T01:49:49Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

coderabbitai · 2026-07-17T01:50:08Z

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (6)

control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/AROSwift/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml is excluded by !**/testdata/**
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/GCP/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml is excluded by !**/testdata/**
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml is excluded by !**/testdata/**
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml is excluded by !**/testdata/**
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml is excluded by !**/testdata/**
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml is excluded by !**/testdata/**

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: ea79e494-3e2a-4a14-8fe4-21d7241c15c7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

📝 Walkthrough

Walkthrough

The konnectivity-server container in the kube-apiserver Deployment now receives --cluster-ca-cert=/etc/konnectivity/ca/ca.crt. A unit test loads the deployment manifest, locates the container, and verifies the flag and certificate path.

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Added test names are static and deterministic; no dynamic Ginkgo titles or generated identifiers were introduced.
Test Structure And Quality	✅ Passed	PASS: The new unit test checks one manifest behavior, has explicit fatal messages for preconditions, and no cluster ops, waits, or cleanup concerns; it matches package style.
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The manifest change only adds --cluster-ca-cert to konnectivity-server; no nodeSelector, affinity, spread, replica, or taint assumptions were introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Added test is a unit test over embedded manifests, with no Ginkgo/e2e code, IP assumptions, or external connectivity.
No-Weak-Crypto	✅ Passed	Changed files only add a manifest flag and a test; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons found.
Container-Privileges	✅ Passed	Changed manifest only adds --cluster-ca-cert; searches found no privileged, hostPID/Network/IPC, capabilities, runAsUser, or allowPrivilegeEscalation fields.
No-Sensitive-Data-In-Logs	✅ Passed	Changed code adds no logging of sensitive data; only manifest args and plain test failures were introduced.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: requiring Konnectivity agents to authenticate with the cluster CA.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 2

🧹 Nitpick comments (1)

control-plane-operator/controllers/hostedcontrolplane/v2/assets/assets_test.go (1)
55-55: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Use the required “When ... it should ...” test description format.

Rename or wrap this test so its case description follows the repository convention, for example When configured with the cluster CA, it should authenticate agents.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@control-plane-operator/controllers/hostedcontrolplane/v2/assets/assets_test.go`
at line 55, Rename TestKonnectivityServerAuthenticatesAgents to use the required
“When ..., it should ...” test description convention, such as describing the
cluster CA configuration and expected agent authentication behavior.
Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@control-plane-operator/controllers/hostedcontrolplane/v2/assets/assets_test.go`:
- Around line 59-60: Update the test around
LoadDeploymentManifest("kube-apiserver") to stop execution immediately when the
lookup returns an error or nil deployment, before any deployment.Spec
dereference; use the test’s fatal/early-return mechanism and apply the same
guard before dereferencing konnectivityServer.Args.
- Around line 71-74: Update the konnectivityServer.Args assertion in the
relevant test to verify that “--cluster-ca-cert” is immediately followed by
“/etc/konnectivity/ca/ca.crt”, using an ordered-pair or exact-subsequence
assertion instead of ContainElements.

---

Nitpick comments:
In
`@control-plane-operator/controllers/hostedcontrolplane/v2/assets/assets_test.go`:
- Line 55: Rename TestKonnectivityServerAuthenticatesAgents to use the required
“When ..., it should ...” test description convention, such as describing the
cluster CA configuration and expected agent authentication behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: fa825fbc-fa44-44fa-aec7-729246c79fbe

📥 Commits

Reviewing files that changed from the base of the PR and between e4576ff and 71820bb.

📒 Files selected for processing (2)

control-plane-operator/controllers/hostedcontrolplane/v2/assets/assets_test.go
control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-apiserver/deployment.yaml

codecov · 2026-07-17T01:58:04Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 44.44%. Comparing base (0a7e9d4) to head (1bc23f9).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9031   +/-   ##
=======================================
  Coverage   44.44%   44.44%           
=======================================
  Files         774      774           
  Lines       96977    96977           
=======================================
  Hits        43105    43105           
  Misses      50897    50897           
  Partials     2975     2975

Flag	Coverage Δ
cmd-support	`38.39% <ø> (ø)`
cpo-hostedcontrolplane	`47.19% <ø> (ø)`
cpo-other	`45.25% <ø> (ø)`
hypershift-operator	`54.22% <ø> (ø)`
other	`32.64% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

bryan-cox · 2026-07-17T11:13:19Z

/retitle OCPBUGS-99014: Authenticate Konnectivity agents with cluster CA

openshift-ci-robot · 2026-07-17T11:13:28Z

@hlipsig: This pull request references Jira Issue OCPBUGS-99014, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

What this PR does / why we need it:

The Konnectivity proxy-server currently accepts agent connections without validating client certificates because its agent listener is not configured with a cluster CA. A reachable client can therefore connect without a certificate signed by the hosted cluster's Konnectivity CA.

Configure --cluster-ca-cert with the existing mounted Konnectivity CA bundle. Legitimate agents already use certificates signed by this CA. Add a regression test that verifies the embedded kube-apiserver manifest retains the authentication setting.

Which issue(s) this PR fixes:

NO-JIRA

Special notes for your reviewer:

Focused tests passed:
GO111MODULE=on GOWORK=off GOFLAGS=-mod=vendor go test -race ./control-plane-operator/controllers/hostedcontrolplane/v2/assets ./control-plane-operator/controllers/hostedcontrolplane/v2/kas

Checklist:

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Summary by CodeRabbit

Bug Fixes

Updated the Konnectivity server configuration to authenticate agents using the cluster CA certificate.

Ensured the kube-apiserver deployment passes the --cluster-ca-cert argument pointing to the mounted Konnectivity CA file.

Tests

Added a unit test that verifies the Konnectivity server container exists in the kube-apiserver manifest and includes the correct --cluster-ca-cert setting.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

bryan-cox · 2026-07-17T11:25:57Z

/approve

openshift-ci · 2026-07-17T11:26:14Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox, hlipsig

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [bryan-cox]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

bryan-cox · 2026-07-17T11:26:25Z

The TestControlPlaneComponents fixture test is failing because the golden fixture files need to be regenerated after adding --cluster-ca-cert to the deployment YAML. You can fix it by running:

UPDATE=true go test ./control-plane-operator/controllers/hostedcontrolplane/...

This will update all the zz_fixture_* YAML files under testdata/kube-apiserver/ (and its subdirectories) to include the new flag.

csrwng · 2026-07-17T13:49:31Z

The PR lgtm, pls fix the unit tests and I can tag.

hlipsig · 2026-07-17T16:19:28Z

The fixture updates are pushed in e95cd3a. The current head now passes Unit Tests (including cpo-hostedcontrolplane), Lint, and Verify. @csrwng, assuming nothing shows up in the e2e jobs this is ready for the /lgtm tag when you have a chance.

csrwng · 2026-07-17T16:23:57Z

/lgtm

openshift-merge-bot · 2026-07-17T16:24:11Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-azure-v2-self-managed
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws
/test e2e-v2-gke

bryan-cox · 2026-07-23T11:42:05Z

/test e2e-aro-hcp

sdminonne · 2026-07-23T12:01:43Z

/retest-required

clebs · 2026-07-23T12:06:27Z

/lgtm

bryan-cox · 2026-07-23T12:07:59Z

/hold cancel

hold was automatically put on from failing CI tests.

muraee · 2026-07-23T12:24:26Z

 	}
 }

+func TestKonnectivityServerAuthenticatesAgents(t *testing.T) {


why is this test here? it should be in the kube-apiserver pkg

openshift-ci-robot · 2026-07-23T13:15:08Z

@hlipsig: Jira Issue Verification Checks: Jira Issue OCPBUGS-99014
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-99014 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

What this PR does / why we need it:

The Konnectivity proxy-server currently accepts agent connections without validating client certificates because its agent listener is not configured with a cluster CA. A reachable client can therefore connect without a certificate signed by the hosted cluster's Konnectivity CA.

Configure --cluster-ca-cert with the existing mounted Konnectivity CA bundle. Legitimate agents already use certificates signed by this CA. Add a regression test that verifies the embedded kube-apiserver manifest retains the authentication setting.

Which issue(s) this PR fixes:

OCPBUGS-99014

Special notes for your reviewer:

Focused tests passed:
GO111MODULE=on GOWORK=off GOFLAGS=-mod=vendor go test -race ./control-plane-operator/controllers/hostedcontrolplane/v2/assets ./control-plane-operator/controllers/hostedcontrolplane/v2/kas

Checklist:

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Summary by CodeRabbit

Bug Fixes

Updated the Konnectivity server configuration to authenticate agents using the cluster CA certificate.

Ensured the kube-apiserver deployment passes the --cluster-ca-cert argument pointing to the mounted Konnectivity CA file.

Tests

Added a unit test that verifies the Konnectivity server container exists in the kube-apiserver manifest and includes the correct --cluster-ca-cert setting.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

clebs · 2026-07-23T13:20:00Z

/cherry-pick release-4.22

openshift-cherrypick-robot · 2026-07-23T13:21:10Z

@clebs: #9031 failed to apply on top of branch "release-4.22":

Applying: fix(konnectivity): authenticate agents with cluster CA
Using index info to reconstruct a base tree...
A	control-plane-operator/controllers/hostedcontrolplane/v2/assets/assets_test.go
Falling back to patching base and 3-way merge...
CONFLICT (modify/delete): control-plane-operator/controllers/hostedcontrolplane/v2/assets/assets_test.go deleted in HEAD and modified in fix(konnectivity): authenticate agents with cluster CA.  Version fix(konnectivity): authenticate agents with cluster CA of control-plane-operator/controllers/hostedcontrolplane/v2/assets/assets_test.go left in tree.
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 fix(konnectivity): authenticate agents with cluster CA

Details

In response to this:

/cherry-pick release-4.22

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Backport pull request openshift#9031 from hlipsig/fix-konnectivity-agent-auth OCPBUGS-99014: Authenticate Konnectivity agents with cluster CA Signed-off-by: Borja Clemente <bclement@redhat.com>

openshift-merge-robot · 2026-07-24T06:00:11Z

Fix included in release 5.0.0-0.nightly-2026-07-23-224236

Backport pull request openshift#9031 from hlipsig/fix-konnectivity-agent-auth OCPBUGS-99014: Authenticate Konnectivity agents with cluster CA Signed-off-by: Borja Clemente <bclement@redhat.com>

Backport pull request #9031 from hlipsig/fix-konnectivity-agent-auth OCPBUGS-99014: Authenticate Konnectivity agents with cluster CA Signed-off-by: Borja Clemente <bclement@redhat.com>

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 17, 2026

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 17, 2026

openshift-ci Bot added do-not-merge/needs-area area/control-plane-operator Indicates the PR includes changes for the control plane operator - in an OCP release and removed do-not-merge/needs-area labels Jul 17, 2026

coderabbitai Bot reviewed Jul 17, 2026

View reviewed changes

Comment thread control-plane-operator/controllers/hostedcontrolplane/v2/assets/assets_test.go Outdated

Comment thread control-plane-operator/controllers/hostedcontrolplane/v2/assets/assets_test.go Outdated

hlipsig force-pushed the fix-konnectivity-agent-auth branch from 7af17d9 to 69928e6 Compare July 17, 2026 02:30

openshift-ci Bot changed the title ~~NO-JIRA: Authenticate Konnectivity agents with cluster CA~~ OCPBUGS-99014: Authenticate Konnectivity agents with cluster CA Jul 17, 2026

openshift-ci-robot added the jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. label Jul 17, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 17, 2026

hlipsig marked this pull request as ready for review July 17, 2026 16:11

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 17, 2026

openshift-ci Bot requested review from clebs and muraee July 17, 2026 16:13

openshift-ci Bot assigned csrwng Jul 17, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 17, 2026

openshift-ci Bot assigned clebs Jul 23, 2026

openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 23, 2026

muraee reviewed Jul 23, 2026

View reviewed changes

celebdor merged commit b4e1ba3 into openshift:main Jul 23, 2026
38 of 44 checks passed

clebs mentioned this pull request Jul 23, 2026

[release-4.22] OCPBUGS-99104: fix(backport): konnectivity agent auth #9077

Merged

4 tasks

coderabbitai Bot mentioned this pull request Jul 23, 2026

CNTRLPLANE-400: feat(remediationAllowed in NP): propagate MHC RemediationAllowed to NodePool Ready condition #9019

Open

5 tasks

coderabbitai Bot mentioned this pull request Jul 24, 2026

CNTRLPLANE-3919: data race in TestEnqueueNodePoolsForCloudConfig #9095

Merged

2 tasks

coderabbitai Bot mentioned this pull request Jul 24, 2026

OCPBUGS-99021: Use separate certificate signers for konnectivity #9098

Open

4 tasks

clebs mentioned this pull request Jul 24, 2026

[release-4.17] OCPBUGS-99079: fix(backport): konnectivity agent auth #9104

Merged

4 tasks

Nirshal mentioned this pull request Jul 24, 2026

CNTRLPLANE-3870: add periodic e2e-aro-hcp test for release-5.0 openshift/release#82403

Open

4 tasks

Uh oh!

Conversation

hlipsig commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

Summary by CodeRabbit

Uh oh!

openshift-merge-bot Bot commented Jul 17, 2026

Uh oh!

openshift-ci-robot commented Jul 17, 2026

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

Uh oh!

openshift-ci Bot commented Jul 17, 2026

Uh oh!

coderabbitai Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Walkthrough

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

bryan-cox commented Jul 17, 2026

Uh oh!

openshift-ci-robot commented Jul 17, 2026

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

Summary by CodeRabbit

Uh oh!

bryan-cox commented Jul 17, 2026

Uh oh!

openshift-ci Bot commented Jul 17, 2026

Uh oh!

bryan-cox commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

csrwng commented Jul 17, 2026

Uh oh!

hlipsig commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

csrwng commented Jul 17, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 17, 2026

Uh oh!

bryan-cox commented Jul 23, 2026

Uh oh!

sdminonne commented Jul 23, 2026

Uh oh!

clebs commented Jul 23, 2026

Uh oh!

bryan-cox commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

muraee Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

openshift-ci-robot commented Jul 23, 2026

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

Summary by CodeRabbit

Uh oh!

clebs commented Jul 23, 2026

hlipsig commented Jul 17, 2026 •

edited

Loading

coderabbitai Bot commented Jul 17, 2026 •

edited

Loading

codecov Bot commented Jul 17, 2026 •

edited

Loading

bryan-cox commented Jul 17, 2026 •

edited

Loading

hlipsig commented Jul 17, 2026 •

edited

Loading

bryan-cox commented Jul 23, 2026 •

edited

Loading