Update Kube-OVN to v1.13.10 #847
Conversation
|
""" WalkthroughThis update modifies the Kube-OVN packaging and deployment process. The Makefile now dynamically sets the KUBEOVN_TAG version by extracting it from the chart YAML, and updates the Dockerfile's version argument accordingly. The Dockerfile for the kube-ovn image has been greatly simplified to use a prebuilt image rather than building from source. Helm chart and container image versions are bumped from v1.13.8 to v1.13.10, and certain volume mount paths in the DaemonSet YAML are updated to use new value references. Additionally, a patch disabling the NetworkManager syncer is removed. Changes
Sequence Diagram(s)sequenceDiagram
participant Makefile
participant Chart.yaml
participant Dockerfile
Makefile->>Chart.yaml: Extract KUBEOVN_TAG version
Makefile->>Dockerfile: Update ARG VERSION to match chart version
Dockerfile->>ImageRegistry: Pull kubeovn/kube-ovn:${VERSION}
Suggested labels
Suggested reviewers
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (6)
packages/system/kubeovn/Makefile(2 hunks)packages/system/kubeovn/charts/kube-ovn/Chart.yaml(1 hunks)packages/system/kubeovn/charts/kube-ovn/templates/ovncni-ds.yaml(1 hunks)packages/system/kubeovn/charts/kube-ovn/values.yaml(1 hunks)packages/system/kubeovn/images/kubeovn/Dockerfile(1 hunks)packages/system/kubeovn/images/kubeovn/patches/disable-nm-syncer.diff(0 hunks)
💤 Files with no reviewable changes (1)
- packages/system/kubeovn/images/kubeovn/patches/disable-nm-syncer.diff
🔇 Additional comments (6)
packages/system/kubeovn/charts/kube-ovn/values.yaml (1)
13-13: Bump image tag to v1.13.10
The global image tag was correctly updated to match the bumped Helm chart and application version.packages/system/kubeovn/charts/kube-ovn/Chart.yaml (1)
18-24: Synchronize chart and appVersion
BothversionandappVersionwere bumped tov1.13.10to align with the new release. Ensure that the Helm chart packaging and all downstream deployments reference this updated version.packages/system/kubeovn/charts/kube-ovn/templates/ovncni-ds.yaml (2)
274-274: Use configurableLOCAL_BIN_DIRfor local-bin volume
Replacing the hardcoded path with.Values.cni_conf.LOCAL_BIN_DIRimproves flexibility. Confirm thatcni_conf.LOCAL_BIN_DIRhas a sensible default invalues.yamland that togglingMOUNT_LOCAL_BIN_DIRworks as intended.
279-279: Reviewovs-ipsec-keyshostPath mapping
Mounting.Values.OPENVSWITCH_DIR(/etc/origin/openvswitch) into/etc/ovs_ipsec_keysmay override the entire Open vSwitch directory rather than a dedicated keys path. Verify that IPsec keys are indeed stored underOPENVSWITCH_DIR; if not, consider introducing a separate value (e.g.ovs_ipsec_keys_dir) to avoid unintended volume overlap.packages/system/kubeovn/images/kubeovn/Dockerfile (1)
1-2: Simplified Dockerfile to use prebuilt image
The Dockerfile now cleanly pulls thekubeovn/kube-ovn:${VERSION}image, removing multi-stage build complexity. Ensure that theVERSIONARG is correctly set by the Makefile update target.packages/system/kubeovn/Makefile (1)
16-17: Dynamically sync Dockerfile version ARG
Good addition: extracting the chart'sversion:and updatingARG VERSIONin the Dockerfile ensures consistency. Verify that thissed -iinvocation works across your CI environments (e.g., GNU vs BSDsed).
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
packages/system/kubeovn/images/kubeovn/Dockerfile (1)
2-2: Consider pinning to an immutable image digest
Relying on a mutable tag can lead to non‑reproducible builds if thev1.13.10tag is ever repointed. As an optional enhancement, you can pin the image to a digest:- ARG VERSION=v1.13.10 - FROM kubeovn/kube-ovn:${VERSION} + ARG VERSION=v1.13.10 + ARG KUBEOVN_DIGEST=sha256:<REPLACE_WITH_ACTUAL_DIGEST> + FROM kubeovn/kube-ovn@${KUBEOVN_DIGEST}Retrieve the digest with:
docker pull kubeovn/kube-ovn:v1.13.10 docker inspect --format '{{index .RepoDigests 0}}' kubeovn/kube-ovn:v1.13.10
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (6)
packages/system/kubeovn/Makefile(2 hunks)packages/system/kubeovn/charts/kube-ovn/Chart.yaml(1 hunks)packages/system/kubeovn/charts/kube-ovn/templates/ovncni-ds.yaml(1 hunks)packages/system/kubeovn/charts/kube-ovn/values.yaml(1 hunks)packages/system/kubeovn/images/kubeovn/Dockerfile(1 hunks)packages/system/kubeovn/images/kubeovn/patches/disable-nm-syncer.diff(0 hunks)
💤 Files with no reviewable changes (1)
- packages/system/kubeovn/images/kubeovn/patches/disable-nm-syncer.diff
🚧 Files skipped from review as they are similar to previous changes (4)
- packages/system/kubeovn/charts/kube-ovn/values.yaml
- packages/system/kubeovn/charts/kube-ovn/Chart.yaml
- packages/system/kubeovn/Makefile
- packages/system/kubeovn/charts/kube-ovn/templates/ovncni-ds.yaml
🔇 Additional comments (1)
packages/system/kubeovn/images/kubeovn/Dockerfile (1)
1-2: Bump Kube‑OVN image version
TheARG VERSIONandFROMlines correctly update the base image to v1.13.10, aligning with the Helm chart and Makefile changes.
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
packages/system/kubeovn/images/kubeovn/Dockerfile (2)
1-2: Improve build reproducibility and metadata
To ensure immutable, traceable images, consider:
- Pinning the base image to a specific digest instead of a mutable tag.
- Adding standard OCI labels like
org.opencontainers.image.versionandorg.opencontainers.image.source.Example diff:
- ARG VERSION=v1.13.10 - FROM kubeovn/kube-ovn:${VERSION} + ARG VERSION=v1.13.10 + # pin to digest for immutability + FROM kubeovn/kube-ovn@sha256:<insert-digest-here> + LABEL org.opencontainers.image.version=${VERSION} \ + org.opencontainers.image.source="https://github.com/cozystack/cozystack"
5-9: Guard against missing binaries when setting capabilities
TheRUN setcap…chain assumes these binaries exist at fixed paths, which may vary between image releases. To avoid build failures, wrap eachsetcapin a check or loop:RUN for bin in \ /usr/lib/openvswitch-switch/ovs-vswitchd \ /usr/sbin/xtables-legacy-multi \ /usr/sbin/xtables-nft-multi \ /usr/sbin/ipset \ /usr/bin/ip; do \ [ -f "$bin" ] && setcap CAP_NET_ADMIN,CAP_NET_BIND_SERVICE,CAP_SYS_ADMIN+eip "$bin"; \ done
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (6)
packages/system/kubeovn/Makefile(2 hunks)packages/system/kubeovn/charts/kube-ovn/Chart.yaml(1 hunks)packages/system/kubeovn/charts/kube-ovn/templates/ovncni-ds.yaml(1 hunks)packages/system/kubeovn/charts/kube-ovn/values.yaml(1 hunks)packages/system/kubeovn/images/kubeovn/Dockerfile(1 hunks)packages/system/kubeovn/images/kubeovn/patches/disable-nm-syncer.diff(0 hunks)
💤 Files with no reviewable changes (1)
- packages/system/kubeovn/images/kubeovn/patches/disable-nm-syncer.diff
🚧 Files skipped from review as they are similar to previous changes (4)
- packages/system/kubeovn/charts/kube-ovn/values.yaml
- packages/system/kubeovn/charts/kube-ovn/Chart.yaml
- packages/system/kubeovn/charts/kube-ovn/templates/ovncni-ds.yaml
- packages/system/kubeovn/Makefile
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: Build and Test
Signed-off-by: Andrei Kvapil kvapss@gmail.com
Summary by CodeRabbit