CCXDEV-15776: install config update

[opokornyy]

This PR updates the install-config gatherer to reflect the newly added fields and the changed structure of the configuration.

Categories

• Bugfix
• Data Enhancement
• Feature
• Backporting
• Others (CI, Infrastructure, Documentation)

Sample Archive

• None

Documentation

• None

Unit Tests

• pkg/gatherers/clusterconfig/cluster_config_v1_config_map_test.go
• pkg/gatherers/clusterconfig/gather_mutating_webhook_configurations_test.go
• pkg/gatherers/clusterconfig/gather_validating_webhook_configurations_test.go

Privacy

Yes. There are no sensitive data in the newly collected information.

Changelog

Breaking Changes

No

References

https://issues.redhat.com/browse/CCXDEV-15776

[openshift-ci-robot]

@opokornyy: This pull request references CCXDEV-15776 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.22.0" version, but no target version was set.

Details

In response to this:

This PR updates the install-config gatherer to reflect the newly added fields and the changed structure of the configuration.

Categories

• Bugfix
• Data Enhancement
• Feature
• Backporting
• Others (CI, Infrastructure, Documentation)

Sample Archive

• None

Documentation

• None

Unit Tests

• pkg/gatherers/clusterconfig/cluster_config_v1_config_map_test.go
• pkg/gatherers/clusterconfig/gather_mutating_webhook_configurations_test.go
• pkg/gatherers/clusterconfig/gather_validating_webhook_configurations_test.go

Privacy

Yes. There are no sensitive data in the newly collected information.

Changelog

Breaking Changes

No

References

https://issues.redhat.com/browse/CCXDEV-15776

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: opokornyy

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [opokornyy]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@opokornyy: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-gcp-ovn-techpreview	cd1f038	link	true	/test e2e-gcp-ovn-techpreview
ci/prow/verify-deps	cd1f038	link	true	/test verify-deps
ci/prow/lint	cd1f038	link	true	/test lint

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[opokornyy]

@coderabbitai full review

[coderabbitai]

✅ Actions performed

Full review triggered.

[coderabbitai]

Walkthrough

The PR updates Go toolchain and dependencies across Kubernetes, OpenShift, Prometheus, and auxiliary modules. It refactors anonymization logic in cluster config gathering by introducing helper functions for platform-specific credentials masking. Test coverage expands to verify anonymization across multiple platform types, and test expectations are adjusted to reflect metadata format changes.

Changes

Cohort / File(s)	Summary
Dependency Updates go.mod	Bumps Go toolchain from 1.24.0 to 1.24.6 and adds 1.24.10; extensively upgrades Kubernetes, OpenShift, Prometheus, and auxiliary modules with version bumps across requires and replacements sections; updates numerous indirect dependencies including etcd, OpenTelemetry, gRPC, and crypto stacks.
Platform Anonymization Refactoring pkg/gatherers/clusterconfig/cluster_config_v1_config_map.go	Adds imports for GCP and VSphere platforms; introduces three new helper functions (anonymizeFencing, anonymizeVSphere, anonymizeGCPConfig) to centralize anonymization of platform-specific credentials; expands anonymization flow to cover BareMetal BMC fields, GCP region/project ID, VSphere datacenter/credentials, and fencing credentials across control plane, arbiter, and compute nodes.
Anonymization Test Coverage pkg/gatherers/clusterconfig/cluster_config_v1_config_map_test.go	Adds extensive unit tests for anonymization across VSphere, GCP, BareMetal, and fencing credential scenarios; verifies datacenter, vCenter, region, project ID, DNS private zone, and BMC credential masking; adjusts existing test expectations for install-config formatting.
Test Metadata Adjustments pkg/gatherers/clusterconfig/gather_mutating_webhook_configurations_test.go, pkg/gatherers/clusterconfig/gather_validating_webhook_configurations_test.go	Removes creationTimestamp field from expected metadata in JSON assertions to match updated marshaling behavior.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~50 minutes

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.5.0)

Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions
The command is terminated due to an error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 3

🤖 Fix all issues with AI agents

In `@go.mod`:
- Around line 9-161: The dependency update introduces many new modules including
a pre-release openshift installer (github.com/openshift/installer
v1.4.21-rc2...) and needs a vuln scan; run govulncheck ./... across the repo,
review the report for any findings, and if any vulnerabilities or unacceptable
risks are found pin or rollback offending modules (especially the symbol
github.com/openshift/installer) to a known stable release version or update to a
vetted upstream stable tag; update go.mod accordingly and re-run go mod tidy and
govulncheck until clean, then document the decision in the PR.
- Around line 3-5: Update the go version directives to valid releases: replace
the "go" directive value (currently "1.24.6") with "1.25.7" and update the
"toolchain" line (currently "go1.24.10") to "go1.26.0" so the module uses
officially released Go versions.

In `@pkg/gatherers/clusterconfig/cluster_config_v1_config_map.go`:
- Around line 75-81: The loop over installConfig.BareMetal.Hosts assumes each
element is non-nil and directly dereferences .BMC, which can panic; update the
loop in the cluster_config_v1_config_map logic to check each host for nil before
accessing Host.BMC (e.g., for i := range installConfig.BareMetal.Hosts { if
installConfig.BareMetal.Hosts[i] == nil { continue } ... }) and also consider
guarding Host.BMC for nil before calling anonymize.String on
Username/Password/Address to avoid nil dereference.

[coderabbitai]

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify Go toolchain versions from official releases

echo "=== Checking official Go releases for 1.24.x versions ==="
# Get all available Go versions (limit to avoid truncation)
curl -s https://go.dev/dl/?mode=json | jq -r '.[].version' | grep -E "go1\.24" | sort -V | head -20

Repository: openshift/insights-operator

Length of output: 128

---

🏁 Script executed:

#!/bin/bash
# Alternative method to check Go releases

echo "=== Direct curl test ==="
curl -s "https://go.dev/dl/?mode=json" | head -c 200

echo -e "\n\n=== Checking Go version format validity ==="
# Go versions follow pattern go1.X.Y or go1.X
# 1.24.6 and 1.24.10 follow valid format
# Let's check if we can find any information about Go 1.24 release schedule

echo "Note: Go 1.24 releases may be beyond current release history"
echo "Go version format check: go1.24.6 and go1.24.10 follow valid Go version schema"
echo ""
echo "Checking local Go documentation patterns..."
# Check if these could be valid future releases
echo "1.24.6 format: valid (1.X.Y format)"
echo "1.24.10 format: valid (1.X.Y format)"

Repository: openshift/insights-operator

Length of output: 599

---

🏁 Script executed:

#!/bin/bash
# Check for specific Go 1.24.x versions

echo "=== All Go 1.24.x versions available ==="
curl -s "https://go.dev/dl/?mode=json" | jq -r '.[] | select(.version | startswith("go1.24")) | .version' | sort -V

echo ""
echo "=== Checking for specific versions: 1.24.6 and 1.24.10 ==="
curl -s "https://go.dev/dl/?mode=json" | jq -r '.[] | select(.version == "go1.24.6" or .version == "go1.24.10") | .version'

echo ""
echo "=== Go version range context ==="
curl -s "https://go.dev/dl/?mode=json" | jq -r '.[0:5] | .[] | .version'

Repository: openshift/insights-operator

Length of output: 223

---

Update Go versions to use currently available releases.

The specified Go versions 1.24.6 and toolchain go1.24.10 do not exist in official Go releases. Current stable versions are 1.25.7 and 1.26.0. Update both the go directive and toolchain to use valid, available versions.

🤖 Prompt for AI Agents

In `@go.mod` around lines 3 - 5, Update the go version directives to valid
releases: replace the "go" directive value (currently "1.24.6") with "1.25.7"
and update the "toolchain" line (currently "go1.24.10") to "go1.26.0" so the
module uses officially released Go versions.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash

# Count direct dependencies in the provided snippet
echo "=== Analyzing go.mod dependencies ==="
echo ""

# Check if go.mod exists in repo
if [ -f "go.mod" ]; then
    echo "Found go.mod file"
    
    # Get go version
    head -5 go.mod | grep "^go "
    echo ""
    
    # Count total lines and estimate dependencies
    echo "File statistics:"
    wc -l go.mod
    echo ""
    
    # Extract and count direct dependencies (no // indirect)
    echo "Direct dependencies (from require block without indirect):"
    grep -v "// indirect" go.mod | grep -E "^\s+(github|golang|k8s|sigs|google|go\.|cel\.|gopkg)" | wc -l
    echo ""
    
    # Extract and count indirect dependencies
    echo "Indirect dependencies (marked with // indirect):"
    grep "// indirect" go.mod | wc -l
    echo ""
    
    # Show go.mod require section summary
    echo "Go.mod structure:"
    grep -n "^require\|^)" go.mod | head -20
else
    echo "go.mod not found in repository root"
fi

Repository: openshift/insights-operator

Length of output: 338

---

🏁 Script executed:

#!/bin/bash

# Check the suggested verification tool
echo "=== Checking govulncheck availability and usage ==="
echo ""

# Check if govulncheck is mentioned in Go documentation
echo "govulncheck is a Go vulnerability scanner. Checking usage:"
echo ""

# Since we can't install packages easily, let's check for golang.org/x/vuln references
# and look for any vulnerability-related configs in the repo
if [ -f "go.sum" ]; then
    echo "go.sum exists. Checking for vuln-related entries:"
    grep -i vuln go.sum | head -10 || echo "No vuln entries found in go.sum"
else
    echo "go.sum not found"
fi

echo ""
echo "Checking if there are CI/CD configs that might handle vulnerability checks:"
find . -maxdepth 2 -type f \( -name "*.yml" -o -name "*.yaml" -o -name ".gitignore" \) 2>/dev/null | head -20

Repository: openshift/insights-operator

Length of output: 899

---

🏁 Script executed:

#!/bin/bash

# Check for obviously problematic versions or known issues
echo "=== Checking for specific version concerns ==="
echo ""

# Look at some key dependencies that are commonly scrutinized
if [ -f "go.mod" ]; then
    echo "Key dependencies versions in go.mod:"
    echo ""
    
    # Kubernetes packages
    echo "Kubernetes (k8s.io) versions:"
    grep "^[[:space:]]*k8s.io/" go.mod | head -10
    echo ""
    
    # gRPC
    echo "gRPC versions:"
    grep "^[[:space:]]*google.golang.org/grpc" go.mod
    echo ""
    
    # OpenTelemetry
    echo "OpenTelemetry versions:"
    grep "^[[:space:]]*go.opentelemetry.io" go.mod | head -5
    echo ""
    
    # Check for any pre-release or old versions
    echo "Pre-release or RC versions (if any):"
    grep -E "rc|pre|alpha|beta" go.mod | head -10 || echo "None found"
fi

Repository: openshift/insights-operator

Length of output: 1209

---

Verify security posture and release stability of updated dependencies.

The PR updates 150 dependencies (27 direct, 123 indirect) across multiple ecosystems. Ensure all packages are free from known vulnerabilities and address the presence of a pre-release version: github.com/openshift/installer v1.4.21-rc2.0.20260205115605-acb34201ac99.

Run govulncheck ./... to scan for known vulnerabilities. Confirm whether the RC version of openshift/installer should be pinned to a stable release before merging.

🤖 Prompt for AI Agents

In `@go.mod` around lines 9 - 161, The dependency update introduces many new
modules including a pre-release openshift installer
(github.com/openshift/installer v1.4.21-rc2...) and needs a vuln scan; run
govulncheck ./... across the repo, review the report for any findings, and if
any vulnerabilities or unacceptable risks are found pin or rollback offending
modules (especially the symbol github.com/openshift/installer) to a known stable
release version or update to a vetted upstream stable tag; update go.mod
accordingly and re-run go mod tidy and govulncheck until clean, then document
the decision in the PR.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Add nil check for BareMetal hosts to prevent potential panic.

If Hosts slice contains a nil pointer, accessing BMC will cause a nil pointer dereference.

Proposed fix

 	if installConfig.BareMetal != nil {
 		for i := range installConfig.BareMetal.Hosts {
+			if installConfig.BareMetal.Hosts[i] == nil {
+				continue
+			}
 			installConfig.BareMetal.Hosts[i].BMC.Username = anonymize.String(installConfig.BareMetal.Hosts[i].BMC.Username)
 			installConfig.BareMetal.Hosts[i].BMC.Password = anonymize.String(installConfig.BareMetal.Hosts[i].BMC.Password)
 			installConfig.BareMetal.Hosts[i].BMC.Address = anonymize.String(installConfig.BareMetal.Hosts[i].BMC.Address)
 		}
 	}

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	if installConfig.BareMetal != nil {
	for i := range installConfig.BareMetal.Hosts {
	installConfig.BareMetal.Hosts[i].BMC.Username = anonymize.String(installConfig.BareMetal.Hosts[i].BMC.Username)
	installConfig.BareMetal.Hosts[i].BMC.Password = anonymize.String(installConfig.BareMetal.Hosts[i].BMC.Password)
	installConfig.BareMetal.Hosts[i].BMC.Address = anonymize.String(installConfig.BareMetal.Hosts[i].BMC.Address)
	}
	}
	if installConfig.BareMetal != nil {
	for i := range installConfig.BareMetal.Hosts {
	if installConfig.BareMetal.Hosts[i] == nil {
	continue
	}
	installConfig.BareMetal.Hosts[i].BMC.Username = anonymize.String(installConfig.BareMetal.Hosts[i].BMC.Username)
	installConfig.BareMetal.Hosts[i].BMC.Password = anonymize.String(installConfig.BareMetal.Hosts[i].BMC.Password)
	installConfig.BareMetal.Hosts[i].BMC.Address = anonymize.String(installConfig.BareMetal.Hosts[i].BMC.Address)
	}
	}

🤖 Prompt for AI Agents

In `@pkg/gatherers/clusterconfig/cluster_config_v1_config_map.go` around lines 75
- 81, The loop over installConfig.BareMetal.Hosts assumes each element is
non-nil and directly dereferences .BMC, which can panic; update the loop in the
cluster_config_v1_config_map logic to check each host for nil before accessing
Host.BMC (e.g., for i := range installConfig.BareMetal.Hosts { if
installConfig.BareMetal.Hosts[i] == nil { continue } ... }) and also consider
guarding Host.BMC for nil before calling anonymize.String on
Username/Password/Address to avoid nil dereference.