Skip to content

fix(kubernetes): pin KubeVirt CSI sidecars to SIG Storage releases - #3934

Merged
Aleksei Sviridkin (lexfrei) merged 1 commit into
cozystack:mainfrom
yankawai:tech-1504-pin-kcsi-sidecars
Sep 17, 2026
Merged

fix(kubernetes): pin KubeVirt CSI sidecars to SIG Storage releases#3934
Aleksei Sviridkin (lexfrei) merged 1 commit into
cozystack:mainfrom
yankawai:tech-1504-pin-kcsi-sidecars

Conversation

@yankawai

@yankawai europrinter (yankawai) commented Aug 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What this PR does

Replaces five mutable OpenShift latest image references (four unique sidecar images) in the KubeVirt CSI controller and tenant-node DaemonSet with versioned Kubernetes SIG Storage releases. This addresses the affected references from #3578 without claiming the other references in that issue.

The selected controller versions match the sidecars already used by Cozystack's LINSTOR CSI deployment. Render tests pin every changed container name and image so a mutable tag cannot return silently.

Validation:

  • helm unittest packages/apps/kubernetes: 247/247 passed.
  • helm unittest packages/system/kubevirt-csi-node: 6/6 passed.
  • Live MSK-prod guest-cluster canaries on 2026-08-20 and 2026-08-21 reproduced the failure with the stock chart: the latest sidecars exited on the old CPU with the x86-64-v3 glibc error and the controller stayed in CrashLoopBackOff. A disposable guest cluster with the pinned images reached a 7/7 Ready controller on 2026-08-19 and was removed after the check.

Screenshots

Not a UI change.

Downstream repositories

Walked the trigger map against the four changed template/test files. No package, schema, API, default, CRD, tooling contract, or downstream hardcoded value changes.

Release note

fix(kubernetes): pin KubeVirt CSI sidecars to versioned SIG Storage images that run on pre-x86-64-v3 CPUs

@github-actions github-actions Bot added area/kubernetes Issues or PRs related to the tenant Kubernetes app kind/bug Categorizes issue or PR as related to a bug size/M This PR changes 30-99 lines, ignoring generated files labels Aug 21, 2026
@coderabbitai

coderabbitai Bot commented Aug 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: fa80d341-7ce4-4427-91df-99fcfc215fd8

📥 Commits

Reviewing files that changed from the base of the PR and between 3c780ac and 5fd69a7.

📒 Files selected for processing (4)
  • packages/apps/kubernetes/templates/csi/deploy.yaml
  • packages/apps/kubernetes/tests/kcsi_sidecar_images_test.yaml
  • packages/system/kubevirt-csi-node/templates/deploy.yaml
  • packages/system/kubevirt-csi-node/tests/sidecar_images_test.yaml

Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review.

📝 Walkthrough

Walkthrough

The CSI controller and node templates now use pinned registry.k8s.io sidecar images. New Helm tests verify the exact image references for all updated sidecar containers.

Changes

CSI Sidecar Images

Layer / File(s) Summary
Pin controller sidecar images
packages/apps/kubernetes/templates/csi/deploy.yaml, packages/apps/kubernetes/tests/kcsi_sidecar_images_test.yaml		 The CSI controller uses pinned csi-provisioner, csi-attacher, and livenessprobe images. Helm tests verify the exact versions and container names.
Pin node sidecar images
packages/system/kubevirt-csi-node/templates/deploy.yaml, packages/system/kubevirt-csi-node/tests/sidecar_images_test.yaml		 The CSI node DaemonSet uses pinned csi-node-driver-registrar and livenessprobe images. Helm tests verify the rendered image references.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 5fd69

This PR replaces mutable CSI sidecar images with versioned releases and adds rendered-image regression tests; the validated deployments and storage smoke test show the compatibility issue is addressed, with no actionable merge-blocking risk remaining.

Suggested reviewers: kvaps

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main change: pinning KubeVirt CSI sidecar images to versioned SIG Storage releases.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@yankawai
europrinter (yankawai) force-pushed the tech-1504-pin-kcsi-sidecars branch 2 times, most recently from 19e6d10 to 296d300 Compare August 21, 2026 15:23
scooby87
scooby87 approved these changes Sep 17, 2026
View reviewed changes

@scooby87 scooby87 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM (independent cozy-review pass).

Pullability of all four pinned tags confirmed live against registry.k8s.io (HTTP 200 each): csi-provisioner v6.1.0, csi-attacher v4.10.0, livenessprobe v2.17.0, csi-node-driver-registrar v2.17.0. The change aligns the remaining sidecars with the versioned sig-storage tag pattern already used by the chart siblings (csi-snapshotter, snapshot-controller, csi-resizer) rather than introducing a new one, and origin/main still carries the :latest openshift refs on the same lines. helm-unittest is non-vacuous (reverting to :latest turns both suites RED).

Phase 5b: upgrade is a rolling restart of the csi-controller Deployment and csi-node DaemonSet (brief provisioning/attach pause, no data loss); air-gapped mirrors already sync registry.k8s.io/sig-storage.

Non-blocking: the refs are tag-only (no digest, no cozy-lib.image helper) — strictly better than :latest and identical to the existing siblings; a chart-wide digest-pin + helper-routing pass is a good follow-up, and a Renovate regex-manager for these two files would automate CVE bumps now that they are versioned.

@lexfrei
Aleksei Sviridkin (lexfrei) merged commit 355630a into cozystack:main Sep 17, 2026
15 checks passed
@lexfrei Aleksei Sviridkin (lexfrei) added the kind/backport Categorizes issue or PR as requiring a backport to the current release line label Sep 18, 2026
@github-actions

github-actions Bot commented Sep 18, 2026

Copy link
Copy Markdown

Successfully created backport PR for release-1.6:

@github-actions github-actions Bot mentioned this pull request Sep 18, 2026
Merged
myasnikovdaniil added a commit that referenced this pull request Sep 23, 2026
@myasnikovdaniil
[Backport release-1.6] fix(kubernetes): pin KubeVirt CSI sidecars to …
391425f 
…SIG Storage releases (#4313)

# Description
Backport of #3934 to `release-1.6`.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@scooby87 scooby87 scooby87 approved these changes
@lllamnyp Timofei Larkin (lllamnyp) Awaiting requested review from lllamnyp lllamnyp is a code owner
@kvaps Andrei Kvapil (kvaps) Awaiting requested review from kvaps kvaps is a code owner
@myasnikovdaniil myasnikovdaniil Awaiting requested review from myasnikovdaniil myasnikovdaniil is a code owner
@IvanHunters IvanHunters Awaiting requested review from IvanHunters IvanHunters is a code owner
@lexfrei Aleksei Sviridkin (lexfrei) Awaiting requested review from lexfrei lexfrei is a code owner

Assignees

No one assigned

Labels

area/kubernetes Issues or PRs related to the tenant Kubernetes app kind/backport Categorizes issue or PR as requiring a backport to the current release line kind/bug Categorizes issue or PR as related to a bug size/M This PR changes 30-99 lines, ignoring generated files

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@yankawai @scooby87 @lexfrei