[red-hat-konflux]

Image created from 'https://github.com/openshift/sandboxed-containers-operator?rev=6fc314c64ae49948572aea8cc886abbd6ea4a162'

This PR contains the following updates:

Package	Update	Change
quay.io/redhat-user-workloads/ose-osc-tenant/osc-podvm-builder	digest	c1b8da7 -> 30a366a

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test
This is Konflux nudging PR, not Mintmaker.

[openshift-merge-bot]

Pipeline controller notification

This PR uses the pipeline controller for second-stage tests. Selection and triggering follow the repository configuration.

Use /test ? to list jobs and /pipeline help for commands.

[openshift-ci]

Hi @red-hat-konflux[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: 6d2b2fa

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• Resume reviews
• Trigger review

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: openshift/sandboxed-containers-operator
• Branch: devel
• File: .coderabbit.yaml
• Commit: c26b0bd
• Layers: Repository YAML (base), Central YAML (inherited)
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 6d2b81d4-7ad3-49c4-a41b-859cb33e1586

Commits

Reviewing files that changed from the base of the PR and between dad78d3 and 6d2b2fa.

Files selected for processing: 2

• bundle/manifests/sandboxed-containers-operator.clusterserviceversion.yaml
• config/manager/manager.yaml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 9 remain after this review.

Walkthrough

The PodVM builder image digest changed from c1b8da76…2addd85 to 30a366a0…57d3de1. The update applies to the manager Deployment environment variable and both CSV references.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: Minimal · up to 6d2b2

No actionable merge-blocking risk was identified in this image digest update.

Pre-merge checks: 15

Check name	Status	Explanation
Title check		The title names the change: a Renovate/Konflux dependency update that moves osc-podvm-builder to digest 30a366a. The raw summary confirms the CSV and manager.yaml digest references changed from c1b8da…
Description check		The description names the image, the old and new digests (c1b8da7 to 30a366a), and the source revision. These match the raw summary, which reports the digest change in the CSV and manager.yaml. It als…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names		PASS: The pull request changes only the podvm-builder image digest in two YAML manifests. It adds no Ginkgo test titles or other test-name changes, so it introduces no unstable or overly specific test…
Test Structure And Quality		The pull request changes only two YAML image references. It adds or modifies no Ginkgo test code, It blocks, cluster operations, waits, assertions, setup, or cleanup. The test-structure check is there…
Microshift Test Compatibility		The pull request changes only two image digest references in bundle/manifests/sandboxed-containers-operator.clusterserviceversion.yaml and config/manager/manager.yaml. It adds no Ginkgo e2e tests,…
Single Node Openshift (Sno) Test Compatibility		The pull request changes only the osc-podvm-builder image digest in bundle/manifests/sandboxed-containers-operator.clusterserviceversion.yaml and config/manager/manager.yaml. It adds no Ginkgo t…
Topology-Aware Scheduling Compatibility		PASS — The pull request changes only the RELATED_IMAGE_PODVM_BUILDER digest in config/manager/manager.yaml and the CSV environment variable plus relatedImages entry. It adds no replicas, affinit…
Ote Binary Stdout Contract		PASS: The PR changes only the podvm-builder image digest in config/manager/manager.yaml and the CSV. The image is consumed by generated PodVM Jobs (controllers/image_generator.go:360-367), not by …
Ipv6 And Disconnected Network Test Compatibility		PASS: The pull request changes only two YAML image digest references. It adds no Ginkgo e2e tests and no test code with IPv4 or external-connectivity assumptions.
No-Weak-Crypto		The pull request changes only the podvm-builder image reference in two YAML files. The new references use SHA-256 image digests. No MD5, SHA-1, DES, RC4, 3DES, Blowfish, ECB mode, custom crypto, or se…
Container-Privileges		The pull request changes only the osc-podvm-builder image digest in two manifest references. It does not add privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or `allowPrivilegeEscalat…
No-Sensitive-Data-In-Logs		The pull request changes only two Kubernetes image references from one SHA-256 digest to another. It adds no logging code and exposes no password, token, API key, PII, session ID, hostname, or custome…

Full details: Title check

Explanation

The title names the change: a Renovate/Konflux dependency update that moves osc-podvm-builder to digest 30a366a. The raw summary confirms the CSV and manager.yaml digest references changed from c1b8da76 to 30a366a0, which matches the title's main change.

Full details: Description check

Explanation

The description names the image, the old and new digests (c1b8da7 to 30a366a), and the source revision. These match the raw summary, which reports the digest change in the CSV and manager.yaml. It also includes Renovate configuration notes that are standard for this type of update.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Full details: Stable And Deterministic Test Names

Explanation

PASS: The pull request changes only the podvm-builder image digest in two YAML manifests. It adds no Ginkgo test titles or other test-name changes, so it introduces no unstable or overly specific test names.

Full details: Test Structure And Quality

Explanation

The pull request changes only two YAML image references. It adds or modifies no Ginkgo test code, It blocks, cluster operations, waits, assertions, setup, or cleanup. The test-structure check is therefore not applicable.

Full details: Microshift Test Compatibility

Explanation

The pull request changes only two image digest references in bundle/manifests/sandboxed-containers-operator.clusterserviceversion.yaml and config/manager/manager.yaml. It adds no Ginkgo e2e tests, so the MicroShift test compatibility check does not apply.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

The pull request changes only the osc-podvm-builder image digest in bundle/manifests/sandboxed-containers-operator.clusterserviceversion.yaml and config/manager/manager.yaml. It adds no Ginkgo tests or multi-node assumptions.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS — The pull request changes only the RELATED_IMAGE_PODVM_BUILDER digest in config/manager/manager.yaml and the CSV environment variable plus relatedImages entry. It adds no replicas, affinity, topology spread, node selectors, tolerations, or PDB settings. No topology-aware scheduling issue is introduced.

Full details: Ote Binary Stdout Contract

Explanation

PASS: The PR changes only the podvm-builder image digest in config/manager/manager.yaml and the CSV. The image is consumed by generated PodVM Jobs (controllers/image_generator.go:360-367), not by an OTE openshift-tests binary or suite setup. No main, init, TestMain, or suite setup code changed, and the diff introduces no stdout writes.

Full details: No-Weak-Crypto

Explanation

The pull request changes only the podvm-builder image reference in two YAML files. The new references use SHA-256 image digests. No MD5, SHA-1, DES, RC4, 3DES, Blowfish, ECB mode, custom crypto, or secret/token comparison code was introduced.

Full details: Container-Privileges

Explanation

The pull request changes only the osc-podvm-builder image digest in two manifest references. It does not add privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation: true. The affected manager containers retain runAsNonRoot: true, allowPrivilegeEscalation: false, and dropped capabilities.

Full details: No-Sensitive-Data-In-Logs

Explanation

The pull request changes only two Kubernetes image references from one SHA-256 digest to another. It adds no logging code and exposes no password, token, API key, PII, session ID, hostname, or customer data in logs.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR