[grzpiotrowski]

Add Renovate automation to keep Konflux RPM lockfile synchronized with base image updates.

When Renovate detects a ubi-micro digest update in Containerfile.external-dns-operator:

1. The Dockerfile manager updates the digest
2. The refresh-rpm-lockfiles preset's postUpgradeTasks runs refresh-rpm-lockfiles
3. That tool reads rpms.in.yaml, finds the containerfile path, extracts the image from the Containerfile
4. Regenerates rpms.lock.yaml with the new base image
5. Both files are committed in a single PR

This ensures that openssl-libs and openssl-fips-provider RPM versions stay synchronized with the base image in automated dependency updates.

Followup to #588, #600.

[openshift-merge-bot]

Pipeline controller notification

This PR uses the pipeline controller for second-stage tests. Selection and triggering follow the repository configuration.

Use /test ? to list jobs and /pipeline help for commands.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository YAML (base), Central YAML (inherited)
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 45fc97d0-f769-4918-abff-02360f1df0b4

📥 Commits

Reviewing files that changed from the base of the PR and between 027a077 and f397eb2.

📒 Files selected for processing: 1

• .konflux/rpms.in.yaml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

📝 Walkthrough

The RPM configuration now references Containerfile.external-dns-operator and the UBI9 micro image pattern instead of a pinned image digest. Renovate enables the rpm-lockfile manager and the MintMaker RPM lockfile refresh preset. The README documents automatic base-image synchronization and the manual package update workflow.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to f397e

The automated RPM lockfile refresh workflow is configured consistently and is ready to merge.

Pre-merge checks: 15

Check name	Status	Explanation
Title check		The title clearly identifies the Renovate automation for Konflux RPM lockfile updates and includes the relevant issue reference.
Description check		The description directly explains how Renovate updates the base image digest and regenerates the Konflux RPM lockfile.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names		No test files or Ginkgo test-title calls changed. The pull request only changes Renovate configuration and Konflux RPM documentation/configuration, so it introduces no unstable test names.
Test Structure And Quality		PASS: The pull request changes only renovate.json, .konflux/README.md, and .konflux/rpms.in.yaml. The authoritative diff adds no Ginkgo tests or It() blocks. Therefore the listed test-structur…
Microshift Test Compatibility		The pull request changes only renovate.json, .konflux/README.md, and .konflux/rpms.in.yaml. It adds no Ginkgo e2e tests and introduces no MicroShift-incompatible test APIs or assumptions.
Single Node Openshift (Sno) Test Compatibility		PASS: The pull request changes only renovate.json, .konflux/README.md, and .konflux/rpms.in.yaml. It adds no Ginkgo e2e tests or other test code, so the SNO multi-node compatibility check is not…
Topology-Aware Scheduling Compatibility		PASS: The pull request changes only Renovate configuration and Konflux RPM documentation/input files. It does not modify deployment manifests, operator code, controllers, replica settings, affinity, t…
Ote Binary Stdout Contract		PASS. The pull request changes only renovate.json and Konflux RPM documentation/configuration. It changes no Go files and adds no process-level stdout writes. Existing suite setup sends logs to `Gin…
Ipv6 And Disconnected Network Test Compatibility		PASS: The pull request changes only Renovate configuration and Konflux RPM documentation/configuration. It adds no Ginkgo e2e tests, IPv4 assumptions, or test dependencies on external connectivity.
No-Weak-Crypto		PASS. The pull request changes Renovate configuration, Konflux documentation, and RPM lockfile input. The diff introduces no MD5, SHA1, DES, 3DES, RC4, Blowfish, ECB usage, custom cryptography, or sec…
Container-Privileges		PASS: The pull request changes only renovate.json, .konflux/README.md, and .konflux/rpms.in.yaml. The diff adds no container or Kubernetes privilege settings such as privileged, hostPID, `ho…
No-Sensitive-Data-In-Logs		PASS: The pull request changes only Renovate configuration and Konflux documentation/RPM input. The diff introduces no logging, output statements, credentials, tokens, PII, hostnames, or customer data…

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Test Structure And Quality

Explanation

PASS: The pull request changes only renovate.json, .konflux/README.md, and .konflux/rpms.in.yaml. The authoritative diff adds no Ginkgo tests or It() blocks. Therefore the listed test-structure requirements do not apply.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS: The pull request changes only renovate.json, .konflux/README.md, and .konflux/rpms.in.yaml. It adds no Ginkgo e2e tests or other test code, so the SNO multi-node compatibility check is not applicable.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS: The pull request changes only Renovate configuration and Konflux RPM documentation/input files. It does not modify deployment manifests, operator code, controllers, replica settings, affinity, topology spread constraints, node selectors, tolerations, or PDBs. Therefore it introduces no topology-dependent scheduling constraint covered by this check.

Full details: Ote Binary Stdout Contract

Explanation

PASS. The pull request changes only renovate.json and Konflux RPM documentation/configuration. It changes no Go files and adds no process-level stdout writes. Existing suite setup sends logs to GinkgoWriter, and the unchanged main() contains no direct stdout writes.

Full details: No-Weak-Crypto

Explanation

PASS. The pull request changes Renovate configuration, Konflux documentation, and RPM lockfile input. The diff introduces no MD5, SHA1, DES, 3DES, RC4, Blowfish, ECB usage, custom cryptography, or secret/token comparisons. An existing sha1sum check in Containerfile.external-dns-operator is outside the changed files and is not introduced by this pull request.

Full details: Container-Privileges

Explanation

PASS: The pull request changes only renovate.json, .konflux/README.md, and .konflux/rpms.in.yaml. The diff adds no container or Kubernetes privilege settings such as privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation. The rootfs text in the README describes an image filesystem and is not a privilege declaration.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS: The pull request changes only Renovate configuration and Konflux documentation/RPM input. The diff introduces no logging, output statements, credentials, tokens, PII, hostnames, or customer data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}

[grzpiotrowski]

/retitle NE-2934: Add Renovate automation for Konflux RPM lockfile updates

[openshift-ci-robot]

@grzpiotrowski: This pull request references NE-2934 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.1.0" version, but no target version was set.

Details

In response to this:

Add Renovate automation to keep Konflux RPM lockfile synchronized with base image updates.

When ubi-micro base image updates:

1. Renovate updates the digest in .konflux/rpms.in.yaml
2. Renovate updates the digest in Containerfile.external-dns-operator
3. Runs make konflux-rpm-lock to regenerate .konflux/rpms.lock.yaml with updated RPM versions
4. Includes all three file changes in a single PR

This ensures that openssl-libs and openssl-fips-provider RPM versions stay synchronized with the base image in automated dependency updates.

Followup to #588, #600.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[alebedev87]

/lgtm
/approve

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-fips-operator
/test e2e-aws-operator
/test e2e-azure-infoblox-operator
/test e2e-azure-operator
/test e2e-gcp-operator

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alebedev87

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [alebedev87]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[gcs278]

/assign @pedjak

[pedjak]

issue: The approach here (regex manager + postUpgradeTasks with make konflux-rpm-lock) diverges from the standard pattern used across other openshift repos with RPM lockfiles. It also has several problems: make is likely not in MintMaker's allowedPostUpgradeCommands, regexManagers is deprecated since Renovate v37 (the instance runs v44), and there's no explicit grouping to guarantee the Containerfile and rpms.in.yaml updates land in a single PR.

The standard pattern (used by openshift/hive, openshift/lvm-operator, openshift/assisted-service, etc.) is:

1. Use context: containerfile: in rpms.in.yaml instead of context: image: with a hardcoded digest — this makes the Containerfile the single source of truth for the base image:

   context:
     containerfile:
       file: ../Containerfile.external-dns-operator
       imagePattern: registry.access.redhat.com/ubi9/ubi-micro

2. Extend the MintMaker preset and enable the rpm-lockfile manager:

   "enabledManagers": ["dockerfile", "tekton", "rpm-lockfile"],
   "extends": [
     "github>konflux-ci/mintmaker-presets:refresh-rpm-lockfiles"
   ],

The preset hooks into the Dockerfile manager's postUpgradeTasks — when Renovate updates the ubi-micro digest in the Containerfile, refresh-rpm-lockfiles finds the associated rpms.in.yaml via context.containerfile and regenerates the lockfile automatically. No regex manager or custom post-upgrade commands needed.

The refresh-rpm-lockfiles tool (source) specifically looks for context.containerfile in rpms.in.yaml — it doesn't understand context.image, so the current hardcoded digest approach would be skipped by the standard tooling entirely.

Reference: https://konflux-ci.dev/docs/mintmaker/rpm-lockfile/

[pedjak]

/remove-approve

[pedjak]

/lgtm cancel

[grzpiotrowski]

@pedjak thank you for the review. I made the changes as suggested.

[grzpiotrowski]

/hold

until after the release, in the meantime the rpms are bumped in #628

[grzpiotrowski]

/unhold

[openshift-ci]

@grzpiotrowski: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[pedjak]

/hold it becomes obsolete if/when #654 gets merged.