Skip to content

WIP: resourceread: enable strict decoding for release payload manifests - #1444

Open
machine424 wants to merge 1 commit into
openshift:mainfrom
machine424:strict
Open

WIP: resourceread: enable strict decoding for release payload manifests#1444
machine424 wants to merge 1 commit into
openshift:mainfrom
machine424:strict

Conversation

@machine424

@machine424 machine424 commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

Summary by CodeRabbit

  • Bug Fixes
    • Enabled stricter data validation when reading serialized configuration and operator status information.
    • Invalid or unrecognized fields are now rejected instead of being silently accepted.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 12, 2026
@machine424

Copy link
Copy Markdown
Contributor Author

/pipeline required

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-agnostic-operator
/test e2e-agnostic-ovn
/test e2e-agnostic-ovn-techpreview-serial-1of3
/test e2e-agnostic-ovn-techpreview-serial-2of3
/test e2e-agnostic-ovn-techpreview-serial-3of3
/test e2e-agnostic-ovn-upgrade-into-change
/test e2e-agnostic-ovn-upgrade-out-of-change
/test e2e-aws-ovn-techpreview
/test e2e-hypershift
/test e2e-hypershift-conformance

@coderabbitai

coderabbitai Bot commented Aug 12, 2026

Copy link
Copy Markdown

Walkthrough

The codec factories in resource reading and operator status handling now enable strict serialization. Decoding rejects unknown or invalid fields that non-strict decoding previously tolerated.

Changes

Strict codec decoding

Layer / File(s) Summary
Enable strict codec factories
lib/resourceread/resourceread.go, pkg/cvo/internal/operatorstatus.go
Both codec factories now use serializer.EnableStrict, which changes decoding behavior for unsupported or invalid fields.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the main change: enabling strict decoding for release payload manifests.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The diff contains only two codec option changes; it adds or modifies no Ginkgo test declarations or test titles.
Test Structure And Quality ✅ Passed The diff changes only two production codec factory calls; it adds no test files, Ginkgo blocks, waits, setup, cleanup, or assertions subject to this check.
Microshift Test Compatibility ✅ Passed The diff changes only two non-test Go files and adds no Ginkgo tests or test-like paths, so the MicroShift compatibility check is not applicable.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The diff changes only two codec-factory initializers; it adds no Ginkgo e2e tests or multi-node assumptions, so the SNO check is not applicable.
Topology-Aware Scheduling Compatibility ✅ Passed The commit changes only two serializer.NewCodecFactory calls to EnableStrict; it adds no manifests, replicas, affinity, topology spread, node selectors, tolerations, or PDB constraints.
Ote Binary Stdout Contract ✅ Passed The diff only enables strict codec decoding in two package initializers; it adds no stdout, logging, or suite-setup writes.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed The diff changes only two codec factory options; it adds no Ginkgo e2e tests, IP assumptions, or external connectivity requirements.
No-Weak-Crypto ✅ Passed The diff only adds serializer.EnableStrict to two codec factories; it introduces no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom crypto, or secret comparison.
Container-Privileges ✅ Passed The diff changes only two Go codec constructors; it adds no manifests or privilege-related fields, so no listed container privilege condition is introduced.
No-Sensitive-Data-In-Logs ✅ Passed The diff adds only serializer.EnableStrict to two codec factories; it adds no logging calls, log strings, or sensitive data.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-ci

openshift-ci Bot commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: machine424
Once this PR has been reviewed and has the lgtm label, please assign davidhurta for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@lib/resourceread/resourceread.go`:
- Line 24: Update hack/generate-lib-resources.py so its generated
NewCodecFactory call includes serializer.EnableStrict, then regenerate
lib/resourceread/resourceread.go to reflect the generator output.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: c9a8853c-ffec-475d-80b5-a4cab3aa3653

📥 Commits

Reviewing files that changed from the base of the PR and between f94dc81 and 8bbed5c.

📒 Files selected for processing (2)
  • lib/resourceread/resourceread.go
  • pkg/cvo/internal/operatorstatus.go

var (
scheme = runtime.NewScheme()
codecs = serializer.NewCodecFactory(scheme)
codecs = serializer.NewCodecFactory(scheme, serializer.EnableStrict)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n 'codecs = serializer.NewCodecFactory\(scheme, serializer.EnableStrict\)' \
  hack/generate-lib-resources.py \
  lib/resourceread/resourceread.go

Repository: openshift/cluster-version-operator

Length of output: 172


🏁 Script executed:

set -euo pipefail

printf '%s\n' '--- tracked candidates ---'
git ls-files 'lib/resourceread/resourceread.go' 'hack/generate-lib-resources.py'

printf '%s\n' '--- generated file context ---'
nl -ba lib/resourceread/resourceread.go | sed -n '1,45p'

printf '%s\n' '--- generator references ---'
rg -n -C 4 'CodecFactory|EnableStrict|resourceread|generate' hack/generate-lib-resources.py

Repository: openshift/cluster-version-operator

Length of output: 334


🏁 Script executed:

set -euo pipefail

printf '%s\n' '--- generated file context ---'
cat -n lib/resourceread/resourceread.go | sed -n '1,45p'

printf '%s\n' '--- generator references ---'
rg -n -C 4 'CodecFactory|EnableStrict|resourceread|generate' hack/generate-lib-resources.py

Repository: openshift/cluster-version-operator

Length of output: 5422


Update the generator before regenerating the generated file.

hack/generate-lib-resources.py emits serializer.NewCodecFactory(scheme) while lib/resourceread/resourceread.go uses serializer.EnableStrict. Add the option to the generator, then regenerate the file.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@lib/resourceread/resourceread.go` at line 24, Update
hack/generate-lib-resources.py so its generated NewCodecFactory call includes
serializer.EnableStrict, then regenerate lib/resourceread/resourceread.go to
reflect the generator output.

Source: Coding guidelines

@openshift-ci

openshift-ci Bot commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

@machine424: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-agnostic-ovn 8bbed5c link true /test e2e-agnostic-ovn
ci/prow/e2e-agnostic-ovn-techpreview-serial-1of3 8bbed5c link true /test e2e-agnostic-ovn-techpreview-serial-1of3
ci/prow/e2e-agnostic-ovn-upgrade-into-change 8bbed5c link true /test e2e-agnostic-ovn-upgrade-into-change
ci/prow/e2e-hypershift 8bbed5c link true /test e2e-hypershift
ci/prow/e2e-agnostic-ovn-upgrade-out-of-change 8bbed5c link true /test e2e-agnostic-ovn-upgrade-out-of-change
ci/prow/e2e-aws-ovn-techpreview 8bbed5c link true /test e2e-aws-ovn-techpreview
ci/prow/e2e-agnostic-ovn-techpreview-serial-3of3 8bbed5c link true /test e2e-agnostic-ovn-techpreview-serial-3of3
ci/prow/e2e-agnostic-operator 8bbed5c link true /test e2e-agnostic-operator
ci/prow/e2e-hypershift-conformance 8bbed5c link true /test e2e-hypershift-conformance
ci/prow/e2e-agnostic-ovn-techpreview-serial-2of3 8bbed5c link true /test e2e-agnostic-ovn-techpreview-serial-2of3

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant