Skip to content

STOR-3004: Rebase external-snapshotter to v8.6.0#219

Merged
openshift-merge-bot[bot] merged 66 commits into
openshift:masterfrom
rvagner78:rebase-v8.6.0
Jun 10, 2026
Merged

STOR-3004: Rebase external-snapshotter to v8.6.0#219
openshift-merge-bot[bot] merged 66 commits into
openshift:masterfrom
rvagner78:rebase-v8.6.0

Conversation

@rvagner78

@rvagner78 rvagner78 commented Jun 9, 2026

Copy link
Copy Markdown

Upstream changelogs

Summary of changes

  • Promoted VolumeGroupSnapshot API to GA (v1). Updated controllers to use v1 VolumeGroupSnapshot APIs and set v1beta2 as the stored version during migration.
  • Fixed VolumeSnapshot deletion not being retried when the snapshot is used as a data source for a PVC restore in progress. The controller now returns an error to ensure the workqueue requeues the snapshot until the PVC is no longer pending. The same fix is applied to VolumeGroupSnapshot deletion.
  • Fixed deletion of snapshots that were marked for deletion while the CSI driver was still taking the snapshot.
  • Fix PVC finalizer update retrying on conflict
  • Add HTTP server timeouts to the webhook
  • Bump k8s dependencies to v1.36.1 and Go to 1.26.0

Diff to upstream:

Previous rebase: #202

cc @openshift/storage

Summary by CodeRabbit

  • New Features

    • Volume group snapshot API promoted to v1 (GA) and CRDs updated with v1 schemas.
  • Bug Fixes

    • Snapshot deletion retry behavior and PVC-restore interactions updated.
    • Webhook HTTP server now has explicit read/write/idle timeouts.
  • Dependencies

    • Go bumped to 1.26.x; Kubernetes and ecosystem modules advanced; gRPC/OTel libraries updated.
  • Tests

    • Extensive new unit/integration tests covering group snapshot flows and controllers.
  • Docs

    • Added v8.6 changelog entry.

Fricounet and others added 30 commits October 19, 2025 14:06
… removal

The `RetryOnConflict` function only retries the update of an object if the retured error is an unmodified 429 error. This commit fixes the retry to modify the error into a `controllerUpdateError` only after the `RetryOnConflict` function finishes.
Bumps the github-dependencies group with 11 updates:

| Package | From | To |
| --- | --- | --- |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.78.0` | `1.79.1` |
| [github.com/grpc-ecosystem/grpc-gateway/v2](https://github.com/grpc-ecosystem/grpc-gateway) | `2.27.7` | `2.27.8` |
| [go.etcd.io/etcd/api/v3](https://github.com/etcd-io/etcd) | `3.6.7` | `3.6.8` |
| [go.etcd.io/etcd/client/pkg/v3](https://github.com/etcd-io/etcd) | `3.6.7` | `3.6.8` |
| [go.etcd.io/etcd/client/v3](https://github.com/etcd-io/etcd) | `3.6.7` | `3.6.8` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.47.0` | `0.48.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.49.0` | `0.50.0` |
| [golang.org/x/term](https://github.com/golang/term) | `0.39.0` | `0.40.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.33.0` | `0.34.0` |
| [google.golang.org/genproto/googleapis/api](https://github.com/googleapis/go-genproto) | `0.0.0-20260128011058-8636f8732409` | `0.0.0-20260209200024-4cfbd4190f57` |
| [google.golang.org/genproto/googleapis/rpc](https://github.com/googleapis/go-genproto) | `0.0.0-20260128011058-8636f8732409` | `0.0.0-20260209200024-4cfbd4190f57` |


Updates `google.golang.org/grpc` from 1.78.0 to 1.79.1
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.78.0...v1.79.1)

Updates `github.com/grpc-ecosystem/grpc-gateway/v2` from 2.27.7 to 2.27.8
- [Release notes](https://github.com/grpc-ecosystem/grpc-gateway/releases)
- [Commits](grpc-ecosystem/grpc-gateway@v2.27.7...v2.27.8)

Updates `go.etcd.io/etcd/api/v3` from 3.6.7 to 3.6.8
- [Release notes](https://github.com/etcd-io/etcd/releases)
- [Commits](etcd-io/etcd@v3.6.7...v3.6.8)

Updates `go.etcd.io/etcd/client/pkg/v3` from 3.6.7 to 3.6.8
- [Release notes](https://github.com/etcd-io/etcd/releases)
- [Commits](etcd-io/etcd@v3.6.7...v3.6.8)

Updates `go.etcd.io/etcd/client/v3` from 3.6.7 to 3.6.8
- [Release notes](https://github.com/etcd-io/etcd/releases)
- [Commits](etcd-io/etcd@v3.6.7...v3.6.8)

Updates `golang.org/x/crypto` from 0.47.0 to 0.48.0
- [Commits](golang/crypto@v0.47.0...v0.48.0)

Updates `golang.org/x/net` from 0.49.0 to 0.50.0
- [Commits](golang/net@v0.49.0...v0.50.0)

Updates `golang.org/x/term` from 0.39.0 to 0.40.0
- [Commits](golang/term@v0.39.0...v0.40.0)

Updates `golang.org/x/text` from 0.33.0 to 0.34.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.33.0...v0.34.0)

Updates `google.golang.org/genproto/googleapis/api` from 0.0.0-20260128011058-8636f8732409 to 0.0.0-20260209200024-4cfbd4190f57
- [Commits](https://github.com/googleapis/go-genproto/commits)

Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20260128011058-8636f8732409 to 0.0.0-20260209200024-4cfbd4190f57
- [Commits](https://github.com/googleapis/go-genproto/commits)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-dependencies
- dependency-name: github.com/grpc-ecosystem/grpc-gateway/v2
  dependency-version: 2.27.8
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
- dependency-name: go.etcd.io/etcd/api/v3
  dependency-version: 3.6.8
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
- dependency-name: go.etcd.io/etcd/client/pkg/v3
  dependency-version: 3.6.8
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
- dependency-name: go.etcd.io/etcd/client/v3
  dependency-version: 3.6.8
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
- dependency-name: golang.org/x/crypto
  dependency-version: 0.48.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: github-dependencies
- dependency-name: golang.org/x/net
  dependency-version: 0.50.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: github-dependencies
- dependency-name: golang.org/x/term
  dependency-version: 0.40.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: github-dependencies
- dependency-name: golang.org/x/text
  dependency-version: 0.34.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: github-dependencies
- dependency-name: google.golang.org/genproto/googleapis/api
  dependency-version: 0.0.0-20260209200024-4cfbd4190f57
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
- dependency-name: google.golang.org/genproto/googleapis/rpc
  dependency-version: 0.0.0-20260209200024-4cfbd4190f57
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
…/go_modules/github-dependencies-bb39b6f983

Bump the github-dependencies group with 11 updates
Add unit tests for group snapshots in snapshot-controller
…ot-controller-tests

Add unit tests for group snapshots in csi-snapshotter sidecar
Update cross-referenced sidecar images to latest stable releases:
- csi-provisioner: v6.1.0 -> v6.2.0
- csi-snapshotter: v8.4.0 -> v8.5.0
- snapshot-controller: v8.4.0 -> v8.5.0
- hostpathplugin: v1.11.0 -> v1.17.1

Note: snapshot-conversion-webhook left at v8.0.1 as no published
images exist in registry.k8s.io for this component.

Signed-off-by: Humble Devassy Chirammal <humble.devassy@gmail.com>
…hot_tests

Add more unit tests for group snapshots
…e-versions

deploy: update sidecar image versions
…t-v2

Fix PVC finalizer update retrying on conflict
119a53c3c Merge pull request kubernetes-csi#294 from andyzhangx/patch-10
7c9aa9ba3 fix: upgrade to go1.25.7 to fix CVE-2026-25679

git-subtree-dir: release-tools
git-subtree-split: 119a53c3cce0c04fd422514252ea62c6ff4e3548
Updates aquasecurity/trivy-action from mutable references to SHA-pinned
version to address security vulnerabilities.

- Updates to v0.35.0 (57a97c7e)
- Pins to specific SHA for immutability
- Addresses issue: aquasecurity/trivy#10425

Signed-off-by: Priyanka Saggu <priyankasaggu11929@gmail.com>
Bumps the github-dependencies group with 18 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.79.1` | `1.79.3` |
| [github.com/go-openapi/jsonpointer](https://github.com/go-openapi/jsonpointer) | `0.22.4` | `0.22.5` |
| [github.com/go-openapi/jsonreference](https://github.com/go-openapi/jsonreference) | `0.21.4` | `0.21.5` |
| [github.com/go-openapi/swag](https://github.com/go-openapi/swag) | `0.25.4` | `0.25.5` |
| [github.com/grpc-ecosystem/grpc-gateway/v2](https://github.com/grpc-ecosystem/grpc-gateway) | `2.27.8` | `2.28.0` |
| [github.com/prometheus/procfs](https://github.com/prometheus/procfs) | `0.19.2` | `0.20.1` |
| [go.etcd.io/etcd/api/v3](https://github.com/etcd-io/etcd) | `3.6.8` | `3.6.9` |
| [go.etcd.io/etcd/client/pkg/v3](https://github.com/etcd-io/etcd) | `3.6.8` | `3.6.9` |
| [go.etcd.io/etcd/client/v3](https://github.com/etcd-io/etcd) | `3.6.8` | `3.6.9` |
| [go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.65.0` | `0.67.0` |
| [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.65.0` | `0.67.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go) | `1.40.0` | `1.42.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.40.0` | `1.42.0` |
| [go.opentelemetry.io/proto/otlp](https://github.com/open-telemetry/opentelemetry-proto-go) | `1.9.0` | `1.10.0` |
| [go.yaml.in/yaml/v2](https://github.com/yaml/go-yaml) | `2.4.3` | `2.4.4` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.48.0` | `0.49.0` |
| [golang.org/x/oauth2](https://github.com/golang/oauth2) | `0.35.0` | `0.36.0` |
| [golang.org/x/time](https://github.com/golang/time) | `0.14.0` | `0.15.0` |



Updates `google.golang.org/grpc` from 1.79.1 to 1.79.3
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.79.1...v1.79.3)

Updates `github.com/go-openapi/jsonpointer` from 0.22.4 to 0.22.5
- [Release notes](https://github.com/go-openapi/jsonpointer/releases)
- [Commits](go-openapi/jsonpointer@v0.22.4...v0.22.5)

Updates `github.com/go-openapi/jsonreference` from 0.21.4 to 0.21.5
- [Release notes](https://github.com/go-openapi/jsonreference/releases)
- [Commits](go-openapi/jsonreference@v0.21.4...v0.21.5)

Updates `github.com/go-openapi/swag` from 0.25.4 to 0.25.5
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.25.4...v0.25.5)

Updates `github.com/go-openapi/swag/cmdutils` from 0.25.4 to 0.25.5
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.25.4...v0.25.5)

Updates `github.com/go-openapi/swag/conv` from 0.25.4 to 0.25.5
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.25.4...v0.25.5)

Updates `github.com/go-openapi/swag/fileutils` from 0.25.4 to 0.25.5
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.25.4...v0.25.5)

Updates `github.com/go-openapi/swag/jsonname` from 0.25.4 to 0.25.5
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.25.4...v0.25.5)

Updates `github.com/go-openapi/swag/jsonutils` from 0.25.4 to 0.25.5
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.25.4...v0.25.5)

Updates `github.com/go-openapi/swag/loading` from 0.25.4 to 0.25.5
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.25.4...v0.25.5)

Updates `github.com/go-openapi/swag/mangling` from 0.25.4 to 0.25.5
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.25.4...v0.25.5)

Updates `github.com/go-openapi/swag/netutils` from 0.25.4 to 0.25.5
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.25.4...v0.25.5)

Updates `github.com/go-openapi/swag/stringutils` from 0.25.4 to 0.25.5
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.25.4...v0.25.5)

Updates `github.com/go-openapi/swag/typeutils` from 0.25.4 to 0.25.5
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.25.4...v0.25.5)

Updates `github.com/go-openapi/swag/yamlutils` from 0.25.4 to 0.25.5
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.25.4...v0.25.5)

Updates `github.com/grpc-ecosystem/grpc-gateway/v2` from 2.27.8 to 2.28.0
- [Release notes](https://github.com/grpc-ecosystem/grpc-gateway/releases)
- [Commits](grpc-ecosystem/grpc-gateway@v2.27.8...v2.28.0)

Updates `github.com/prometheus/procfs` from 0.19.2 to 0.20.1
- [Release notes](https://github.com/prometheus/procfs/releases)
- [Commits](prometheus/procfs@v0.19.2...v0.20.1)

Updates `go.etcd.io/etcd/api/v3` from 3.6.8 to 3.6.9
- [Release notes](https://github.com/etcd-io/etcd/releases)
- [Commits](etcd-io/etcd@v3.6.8...v3.6.9)

Updates `go.etcd.io/etcd/client/pkg/v3` from 3.6.8 to 3.6.9
- [Release notes](https://github.com/etcd-io/etcd/releases)
- [Commits](etcd-io/etcd@v3.6.8...v3.6.9)

Updates `go.etcd.io/etcd/client/v3` from 3.6.8 to 3.6.9
- [Release notes](https://github.com/etcd-io/etcd/releases)
- [Commits](etcd-io/etcd@v3.6.8...v3.6.9)

Updates `go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc` from 0.65.0 to 0.67.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.65.0...zpages/v0.67.0)

Updates `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` from 0.65.0 to 0.67.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.65.0...zpages/v0.67.0)

Updates `go.opentelemetry.io/otel` from 1.40.0 to 1.42.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.40.0...v1.42.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace` from 1.40.0 to 1.42.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.40.0...v1.42.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.40.0 to 1.42.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.40.0...v1.42.0)

Updates `go.opentelemetry.io/otel/metric` from 1.40.0 to 1.42.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.40.0...v1.42.0)

Updates `go.opentelemetry.io/otel/sdk` from 1.40.0 to 1.42.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.40.0...v1.42.0)

Updates `go.opentelemetry.io/otel/trace` from 1.40.0 to 1.42.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.40.0...v1.42.0)

Updates `go.opentelemetry.io/proto/otlp` from 1.9.0 to 1.10.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-proto-go/releases)
- [Commits](open-telemetry/opentelemetry-proto-go@v1.9.0...v1.10.0)

Updates `go.yaml.in/yaml/v2` from 2.4.3 to 2.4.4
- [Commits](yaml/go-yaml@v2.4.3...v2.4.4)

Updates `golang.org/x/crypto` from 0.48.0 to 0.49.0
- [Commits](golang/crypto@v0.48.0...v0.49.0)

Updates `golang.org/x/net` from 0.50.0 to 0.51.0
- [Commits](golang/net@v0.50.0...v0.51.0)

Updates `golang.org/x/oauth2` from 0.35.0 to 0.36.0
- [Commits](golang/oauth2@v0.35.0...v0.36.0)

Updates `golang.org/x/sync` from 0.19.0 to 0.20.0
- [Commits](golang/sync@v0.19.0...v0.20.0)

Updates `golang.org/x/sys` from 0.41.0 to 0.42.0
- [Commits](golang/sys@v0.41.0...v0.42.0)

Updates `golang.org/x/term` from 0.40.0 to 0.41.0
- [Commits](golang/term@v0.40.0...v0.41.0)

Updates `golang.org/x/text` from 0.34.0 to 0.35.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.34.0...v0.35.0)

Updates `golang.org/x/time` from 0.14.0 to 0.15.0
- [Commits](golang/time@v0.14.0...v0.15.0)

Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20260209200024-4cfbd4190f57 to 0.0.0-20260226221140-a57be14db171
- [Commits](https://github.com/googleapis/go-genproto/commits)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
- dependency-name: github.com/go-openapi/jsonpointer
  dependency-version: 0.22.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
- dependency-name: github.com/go-openapi/jsonreference
  dependency-version: 0.21.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
- dependency-name: github.com/go-openapi/swag
  dependency-version: 0.25.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
- dependency-name: github.com/go-openapi/swag/cmdutils
  dependency-version: 0.25.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
- dependency-name: github.com/go-openapi/swag/conv
  dependency-version: 0.25.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
- dependency-name: github.com/go-openapi/swag/fileutils
  dependency-version: 0.25.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
- dependency-name: github.com/go-openapi/swag/jsonname
  dependency-version: 0.25.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
- dependency-name: github.com/go-openapi/swag/jsonutils
  dependency-version: 0.25.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
- dependency-name: github.com/go-openapi/swag/loading
  dependency-version: 0.25.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
- dependency-name: github.com/go-openapi/swag/mangling
  dependency-version: 0.25.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
- dependency-name: github.com/go-openapi/swag/netutils
  dependency-version: 0.25.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
- dependency-name: github.com/go-openapi/swag/stringutils
  dependency-version: 0.25.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
- dependency-name: github.com/go-openapi/swag/typeutils
  dependency-version: 0.25.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
- dependency-name: github.com/go-openapi/swag/yamlutils
  dependency-version: 0.25.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
- dependency-name: github.com/grpc-ecosystem/grpc-gateway/v2
  dependency-version: 2.28.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: github-dependencies
- dependency-name: github.com/prometheus/procfs
  dependency-version: 0.20.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: github-dependencies
- dependency-name: go.etcd.io/etcd/api/v3
  dependency-version: 3.6.9
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
- dependency-name: go.etcd.io/etcd/client/pkg/v3
  dependency-version: 3.6.9
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
- dependency-name: go.etcd.io/etcd/client/v3
  dependency-version: 3.6.9
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
- dependency-name: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
  dependency-version: 0.67.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: github-dependencies
- dependency-name: go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  dependency-version: 0.67.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: github-dependencies
- dependency-name: go.opentelemetry.io/otel
  dependency-version: 1.42.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: github-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace
  dependency-version: 1.42.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: github-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
  dependency-version: 1.42.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: github-dependencies
- dependency-name: go.opentelemetry.io/otel/metric
  dependency-version: 1.42.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: github-dependencies
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.42.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: github-dependencies
- dependency-name: go.opentelemetry.io/otel/trace
  dependency-version: 1.42.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: github-dependencies
- dependency-name: go.opentelemetry.io/proto/otlp
  dependency-version: 1.10.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: github-dependencies
- dependency-name: go.yaml.in/yaml/v2
  dependency-version: 2.4.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
- dependency-name: golang.org/x/crypto
  dependency-version: 0.49.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: github-dependencies
- dependency-name: golang.org/x/net
  dependency-version: 0.51.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: github-dependencies
- dependency-name: golang.org/x/oauth2
  dependency-version: 0.36.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: github-dependencies
- dependency-name: golang.org/x/sync
  dependency-version: 0.20.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: github-dependencies
- dependency-name: golang.org/x/sys
  dependency-version: 0.42.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: github-dependencies
- dependency-name: golang.org/x/term
  dependency-version: 0.41.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: github-dependencies
- dependency-name: golang.org/x/text
  dependency-version: 0.35.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: github-dependencies
- dependency-name: golang.org/x/time
  dependency-version: 0.15.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: github-dependencies
- dependency-name: google.golang.org/genproto/googleapis/rpc
  dependency-version: 0.0.0-20260226221140-a57be14db171
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: github-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
…/go_modules/github-dependencies-c4fb5e16f1

Bump the github-dependencies group across 1 directory with 39 updates
…pdate-trivy-action-v0.35.0

security: Update trivy-action to use sha for v0.35.0
…ns-sha

fix: pin github action to exact SHA
de06a09a7 Merge pull request kubernetes-csi#297 from andyzhangx/patch-11
fc719f31e fix: Update Go version from 1.25.8 to 1.25.9
c24a730ec Merge pull request kubernetes-csi#296 from jsafrane/pin-github-actions-sha
59b456b86 fix: pin github action to exact SHA
061f6eedc Merge pull request kubernetes-csi#295 from kubernetes-csi/security/update-trivy-action-v0.35.0
6c16f30b6 security: Update trivy-action to v0.35.0

git-subtree-dir: release-tools
git-subtree-split: de06a09a7a68bc8da0a275094ade1f5ea7a1a995
Signed-off-by: Eddie Torres <torredil@amazon.com>
…ontroller_tests

Add unit tests for group snapshots
dependabot Bot and others added 7 commits May 27, 2026 05:36
Bumps the k8s-dependencies group with 2 updates in the / directory: [sigs.k8s.io/apiserver-network-proxy/konnectivity-client](https://github.com/kubernetes-sigs/apiserver-network-proxy) and [sigs.k8s.io/structured-merge-diff/v6](https://github.com/kubernetes-sigs/structured-merge-diff).


Updates `sigs.k8s.io/apiserver-network-proxy/konnectivity-client` from 0.34.0 to 0.35.0
- [Release notes](https://github.com/kubernetes-sigs/apiserver-network-proxy/releases)
- [Changelog](https://github.com/kubernetes-sigs/apiserver-network-proxy/blob/master/RELEASE.md)
- [Commits](kubernetes-sigs/apiserver-network-proxy@v0.34.0...v0.35.0)

Updates `sigs.k8s.io/structured-merge-diff/v6` from 6.3.2 to 6.4.0
- [Release notes](https://github.com/kubernetes-sigs/structured-merge-diff/releases)
- [Changelog](https://github.com/kubernetes-sigs/structured-merge-diff/blob/master/RELEASE.md)
- [Commits](kubernetes-sigs/structured-merge-diff@v6.3.2...v6.4.0)

---
updated-dependencies:
- dependency-name: sigs.k8s.io/apiserver-network-proxy/konnectivity-client
  dependency-version: 0.35.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: k8s-dependencies
- dependency-name: sigs.k8s.io/structured-merge-diff/v6
  dependency-version: 6.4.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: k8s-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
…/github_actions/aquasecurity/trivy-action-0.36.0

Bump aquasecurity/trivy-action from 0.35.0 to 0.36.0
…/go_modules/k8s-dependencies-ef8045fa86

Bump the k8s-dependencies group across 1 directory with 2 updates
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jun 9, 2026
@openshift-ci-robot

openshift-ci-robot commented Jun 9, 2026

Copy link
Copy Markdown

@rvagner78: This pull request references STOR-3004 which is a valid jira issue.

Details

In response to this:

Upstream changelogs

Summary of changes

  • Promoted VolumeGroupSnapshot API to GA (v1). Updated controllers to use v1 VolumeGroupSnapshot APIs and set v1beta2 as the stored version during migration.
  • Fixed VolumeSnapshot deletion not being retried when the snapshot is used as a data source for a PVC restore in progress. The controller now returns an error to ensure the workqueue requeues the snapshot until the PVC is no longer pending. The same fix is applied to VolumeGroupSnapshot deletion.
  • Fixed deletion of snapshots that were marked for deletion while the CSI driver was still taking the snapshot.
  • Fix PVC finalizer update retrying on conflict
  • Add HTTP server timeouts to the webhook
  • Bump k8s dependencies to v1.36.1 and Go to 1.26.0

Diff to upstream:

Previous rebase: #202

cc @openshift/storage

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai

coderabbitai Bot commented Jun 9, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 0af482e4-2c03-4bb5-b92d-9ff3879795c5

📥 Commits

Reviewing files that changed from the base of the PR and between c611294 and 151ed79.

📒 Files selected for processing (2)
  • .ci-operator.yaml
  • Dockerfile.snapshot-controller.openshift.rhel7
✅ Files skipped from review due to trivial changes (2)
  • .ci-operator.yaml
  • Dockerfile.snapshot-controller.openshift.rhel7

Walkthrough

Promotes volume group snapshot APIs, clients, informers, listers, and controller paths to v1, updates CRDs and deployment manifests, refreshes tests, and bumps module and release tooling dependencies.

Changes

VolumeGroupSnapshot v1 promotion

Layer / File(s) Summary
API types and CRDs
client/apis/volumegroupsnapshot/v1/*, client/config/crd/*
Adds volumegroupsnapshot v1 API types and registration, and updates CRDs to include v1 schemas with validations and printer columns.
Generated clients and scheme registration
client/clientset/versioned/*, client/clientset/versioned/typed/volumegroupsnapshot/v1*, client/clientset/versioned/fake/*
Generates typed v1 clients, updates clientset accessors to include GroupsnapshotV1, registers v1 types into the scheme, and adds fake client implementations for v1.
Informers and listers
client/informers/externalversions/*, client/listers/volumegroupsnapshot/*
Adds v1 informer and lister packages, updates shared informer factory mappings and list/watch wiring to use v1 schemes and context-aware semantics.
Controller wiring and utilities
cmd/*, pkg/common-controller/*, pkg/sidecar-controller/*, pkg/utils/*
Switches controller and sidecar code from v1beta2 to v1 types/clients, updates status/update/finalizer flows, patch helpers, and deletion retry behavior when snapshots are used for PVC restores.
Generated client refactors (gentype) for beta versions
client/clientset/versioned/typed/volumegroupsnapshot/v1beta*, client/.../fake/*
Refactors many beta typed clients and fakes to use client-go gentilized generic wrappers (ClientWithList/FakeClientWithList) and updates constructors/serializer defaulting.
Tests
pkg/*/*_test.go
Adds and updates extensive unit tests for group snapshot controller, sidecar CSI handler, group_snapshotter gRPC interactions, informer/cache behavior, and metrics timing using v1 types.
Manifests, tooling, and deps
deploy/*, CHANGELOG/*, go.mod, client/go.mod, pkg/webhook/*, release-tools/*
Bumps images in manifests, adds v8.6.0 changelog, refreshes root and client module dependencies and replace directives, adds webhook server timeouts, and pins CI/workflow actions and build images.

🎯 5 (Critical) | ⏱️ ~120 minutes

Suggested labels: approved, lgtm

Suggested reviewers:

  • dfajmon
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

@openshift-ci openshift-ci Bot requested review from dfajmon and jsafrane June 9, 2026 13:29

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 6

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (7)
pkg/common-controller/groupsnapshot_controller_helper.go (5)

1650-1654: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Use the function ctx for member snapshot deletions.

Line 1653 uses context.TODO() even though processGroupSnapshotWithDeletionTimestamp already receives ctx. This drops caller cancellation/timeout semantics during delete loops.

As per coding guidelines, Go paths should propagate context.Context for cancellation and timeouts.

Suggested fix
-		err := ctrl.clientset.SnapshotV1().
+		err := ctrl.clientset.SnapshotV1().
 			VolumeSnapshots(groupSnapshot.Namespace).
-			Delete(context.TODO(), snapshot.Name, metav1.DeleteOptions{})
+			Delete(ctx, snapshot.Name, metav1.DeleteOptions{})
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/common-controller/groupsnapshot_controller_helper.go` around lines 1650 -
1654, The deletion loop in processGroupSnapshotWithDeletionTimestamp uses
context.TODO() which discards caller cancellation/timeouts; update the Delete
calls inside the loop that iterate over snapshotMembers to pass the existing ctx
parameter instead of context.TODO(), i.e., replace context.TODO() in
ctrl.clientset.SnapshotV1().VolumeSnapshots(...).Delete(...) with the function's
ctx so caller context is propagated.

Source: Coding guidelines


98-102: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Check UpdateStatus error before emitting event with returned object.

Line 101 emits an event using newSnapshot before validating err. On API failure, newSnapshot may be nil and this path can fail noisily.

Suggested fix
 	newSnapshot, err := ctrl.clientset.GroupsnapshotV1().VolumeGroupSnapshots(groupSnapshotClone.Namespace).UpdateStatus(context.TODO(), groupSnapshotClone, metav1.UpdateOptions{})
-
-	// Emit the event even if the status update fails so that user can see the error
-	ctrl.eventRecorder.Event(newSnapshot, eventtype, reason, message)
-
 	if err != nil {
+		// Emit against the original object when status update fails.
+		ctrl.eventRecorder.Event(groupSnapshot, eventtype, reason, message)
 		klog.V(4).Infof("updating VolumeGroupSnapshot[%s] error status failed %v", utils.GroupSnapshotKey(groupSnapshot), err)
 		return err
 	}
+	ctrl.eventRecorder.Event(newSnapshot, eventtype, reason, message)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/common-controller/groupsnapshot_controller_helper.go` around lines 98 -
102, The code calls
ctrl.clientset.GroupsnapshotV1().VolumeGroupSnapshots(...).UpdateStatus and then
immediately uses the returned newSnapshot in ctrl.eventRecorder.Event without
checking err; if UpdateStatus failed newSnapshot may be nil. Fix by checking err
after UpdateStatus and only use newSnapshot when err == nil; when err != nil
emit the event using the original groupSnapshotClone (or otherwise non-nil
object) and include or record the error; update the block around UpdateStatus,
newSnapshot, err and the ctrl.eventRecorder.Event call to validate err first and
choose the safe object to pass to Event.

1406-1407: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Compare ReadyToUse values, not pointer addresses.

Line 1406 compares pointer identities. Different allocations with the same boolean value still compare unequal, which can trigger unnecessary status sync/requeue churn.

Suggested fix
-	if groupSnapshot.Status.ReadyToUse != nil && groupSnapshotContent.Status.ReadyToUse != nil && groupSnapshot.Status.ReadyToUse != groupSnapshotContent.Status.ReadyToUse {
+	if groupSnapshot.Status.ReadyToUse != nil && groupSnapshotContent.Status.ReadyToUse != nil && *groupSnapshot.Status.ReadyToUse != *groupSnapshotContent.Status.ReadyToUse {
 		return true
 	}
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/common-controller/groupsnapshot_controller_helper.go` around lines 1406 -
1407, The current check compares pointer addresses for ReadyToUse which can
differ even when values are equal; change the comparison to compare the
dereferenced boolean values instead: after ensuring
groupSnapshot.Status.ReadyToUse != nil && groupSnapshotContent.Status.ReadyToUse
!= nil, use *groupSnapshot.Status.ReadyToUse !=
*groupSnapshotContent.Status.ReadyToUse (i.e., compare the boolean contents) so
equal true/false values don't trigger unnecessary updates.

161-171: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Do not swallow Update failure in default class assignment.

After Line 161 fails, the function still proceeds to cache update and returns success (nil error). That can hide API failures and pass a nil snapshot downstream.

Suggested fix
 	newGroupSnapshot, err := ctrl.clientset.GroupsnapshotV1().VolumeGroupSnapshots(groupSnapshotClone.Namespace).Update(context.TODO(), groupSnapshotClone, metav1.UpdateOptions{})
 	if err != nil {
 		klog.V(4).Infof("updating VolumeGroupSnapshot[%s] default group snapshot class failed %v", utils.GroupSnapshotKey(groupSnapshot), err)
+		return nil, groupSnapshot, err
 	}
 	_, updateErr := ctrl.storeGroupSnapshotUpdate(newGroupSnapshot)
 	if updateErr != nil {
@@
 	return defaultClasses[0], newGroupSnapshot, nil
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/common-controller/groupsnapshot_controller_helper.go` around lines 161 -
171, The Update error from
ctrl.clientset.GroupsnapshotV1().VolumeGroupSnapshots(...).Update is currently
logged then ignored; change the code in setDefaultGroupSnapshotClass so that if
Update returns a non-nil err you stop processing and return that error (do not
proceed to call storeGroupSnapshotUpdate or return a nil error), and only call
ctrl.storeGroupSnapshotUpdate when newGroupSnapshot is non-nil and Update
succeeded; specifically update the block that calls Update to return the error
(with appropriate zero-value for the VolumeGroupSnapshot return) instead of
continuing to the cache update and returning nil.

1552-1554: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Fix unreachable dynamic-content fallback condition.

Line 1552 uses &groupSnapshot.Spec.Source.VolumeGroupSnapshotContentName == nil, which is always false. This prevents the fallback content-name derivation path from ever running.

Suggested fix
-	if groupSnapshotContentName == "" && &groupSnapshot.Spec.Source.VolumeGroupSnapshotContentName == nil {
+	if groupSnapshotContentName == "" && groupSnapshot.Spec.Source.VolumeGroupSnapshotContentName == nil {
 		groupSnapshotContentName = utils.GetDynamicSnapshotContentNameForGroupSnapshot(groupSnapshot)
 	}
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/common-controller/groupsnapshot_controller_helper.go` around lines 1552 -
1554, The condition that checks for an absent content name is using the
address-of operator mistakenly: change the test from using
"&groupSnapshot.Spec.Source.VolumeGroupSnapshotContentName == nil" to directly
comparing the pointer field to nil (i.e.,
"groupSnapshot.Spec.Source.VolumeGroupSnapshotContentName == nil") so the
fallback call to
utils.GetDynamicSnapshotContentNameForGroupSnapshot(groupSnapshot) runs when
groupSnapshotContentName is empty and the Source.VolumeGroupSnapshotContentName
pointer is actually nil; update the conditional around groupSnapshotContentName
and groupSnapshot.Spec.Source.VolumeGroupSnapshotContentName accordingly.
pkg/common-controller/framework_test.go (1)

312-320: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Use groupContents for group snapshot content create/update checks.

Line 317 and Line 384 read from r.contents (volume snapshot content map) while handling volumegroupsnapshotcontents. This can produce incorrect AlreadyExists/version-conflict behavior in tests.

Suggested fix
-		_, found := r.contents[content.Name]
+		_, found := r.groupContents[content.Name]
 		if found {
 			return true, nil, fmt.Errorf("cannot create content %s: content already exists", content.Name)
 		}
@@
-		storedVolume, found := r.contents[content.Name]
+		storedGroupContent, found := r.groupContents[content.Name]
 		if found {
-			storedVer, _ := strconv.Atoi(storedVolume.ResourceVersion)
+			storedVer, _ := strconv.Atoi(storedGroupContent.ResourceVersion)
 			requestedVer, _ := strconv.Atoi(content.ResourceVersion)

Also applies to: 379-387

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/common-controller/framework_test.go` around lines 312 - 320, The
create/update handlers that match action.Matches("create",
"volumegroupsnapshotcontents") (and the update path) currently check r.contents
for existence but should check r.groupContents (the volume group snapshot
content map) instead; update the existence checks and any lookups that reference
r.contents to use r.groupContents when the object is a
*groupsnapshotv1.VolumeGroupSnapshotContent so the tests get correct
AlreadyExists/version-conflict behavior.
deploy/kubernetes/snapshot-controller/setup-snapshot-controller.yaml (1)

35-45: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Add baseline container hardening and resource limits.

This deployment block currently omits explicit container security hardening and CPU/memory limits, which weakens default runtime protections.

As per coding guidelines, Kubernetes manifests should set restrictive securityContext and define resource limits for every container.

Suggested hardening patch
       containers:
         - name: snapshot-controller
           image: registry.k8s.io/sig-storage/snapshot-controller:v8.5.0
+          securityContext:
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@deploy/kubernetes/snapshot-controller/setup-snapshot-controller.yaml` around
lines 35 - 45, The snapshot-controller container block is missing a restrictive
securityContext and resource requests/limits; update the container named
"snapshot-controller" to include a securityContext (e.g., runAsNonRoot: true,
runAsUser: non-root UID, readOnlyRootFilesystem: true, allowPrivilegeEscalation:
false, capabilities: drop: ["ALL"]) and add a resources section with reasonable
requests and limits for cpu and memory (both requests and limits set) to enforce
QoS; keep existing args and imagePullPolicy unchanged and ensure fields are
added under the same container definition so Kubernetes applies the hardening
and resource constraints.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@client/apis/volumegroupsnapshot/v1/types.go`:
- Around line 355-358: Remove the misplaced readiness comment from the
CreationTime field documentation: locate the CreationTime docstring in
client/apis/volumegroupsnapshot/v1/types.go and delete the sentence "If not
specified, it means the readiness of a group snapshot is unknown" (this belongs
to ReadyToUse), leaving only the creation-time related comments; ensure
ReadyToUse's documentation contains the readiness note instead.

In `@client/go.mod`:
- Line 3: Update the Go version directive in client/go.mod from "go 1.25.8" to
match the repo/tooling (use "go 1.26.3" or at least "go 1.26.0") so it aligns
with CSI_PROW_GO_VERSION_BUILD and the root module; edit the go directive in
client/go.mod accordingly or add a short comment in the module explaining an
intentional difference if you must remain at 1.25.x.

In `@pkg/sidecar-controller/csi_handler_test.go`:
- Around line 145-161: The test is missing an assertion for the generated
snapshot name; update the subtest so after calling h.CreateGroupSnapshot you
also assert the first return value (snapshotName) equals the expected
deterministic name when groupSnapshotNameUUIDLength is -1 (i.e., no UUID
suffix). Locate the call to NewCSIHandler(...) and the CreateGroupSnapshot(...)
invocation in the test and add a check that the returned snapshotName (the first
returned value) matches the expected name for prefix "grp-snap" with UUIDLength
-1 (ensure the test fails if a UUID suffix is present).

In `@pkg/sidecar-controller/groupsnapshot_controller_test.go`:
- Line 444: The test setup currently ignores errors from store.Add(contentCopy)
(and other similar _ = store.Add(...) calls); update each Add(...) invocation to
check the returned error and fail the test on error (e.g., if err :=
store.Add(contentCopy); err != nil { t.Fatalf("store.Add failed: %v", err) } or
use require.NoError(t, err)). Replace all occurrences of ignored Add calls
(store.Add) in groupsnapshot_controller_test.go so setup insertion failures
surface immediately instead of being silently ignored.
- Around line 66-69: Update the test fixture to use the v1 API version
consistently: locate the newGroupSnapshotContent test helper (and any creation
of VolumeGroupSnapshotRef) and change its hardcoded APIVersion from
"groupsnapshot.storage.k8s.io/v1beta2" to "groupsnapshot.storage.k8s.io/v1" so
the v1 test fixture and the created GroupSnapshotContent objects use the same
API version and avoid hiding version-contract regressions.

In `@pkg/sidecar-controller/groupsnapshot_helper_test.go`:
- Line 114: Test setup is silently ignoring errors from
classIndexer.Add(newVolumeGroupSnapshotClass(...)), which can hide failing
preconditions; update each call to classIndexer.Add (e.g., the usages that call
newVolumeGroupSnapshotClass("class-a", mockDriverName) and the other instances
noted) to check the returned error and fail the test immediately (t.Fatalf or
require.NoError) if non-nil so test setup errors are explicit and cause test
failure rather than being ignored.

---

Outside diff comments:
In `@deploy/kubernetes/snapshot-controller/setup-snapshot-controller.yaml`:
- Around line 35-45: The snapshot-controller container block is missing a
restrictive securityContext and resource requests/limits; update the container
named "snapshot-controller" to include a securityContext (e.g., runAsNonRoot:
true, runAsUser: non-root UID, readOnlyRootFilesystem: true,
allowPrivilegeEscalation: false, capabilities: drop: ["ALL"]) and add a
resources section with reasonable requests and limits for cpu and memory (both
requests and limits set) to enforce QoS; keep existing args and imagePullPolicy
unchanged and ensure fields are added under the same container definition so
Kubernetes applies the hardening and resource constraints.

In `@pkg/common-controller/framework_test.go`:
- Around line 312-320: The create/update handlers that match
action.Matches("create", "volumegroupsnapshotcontents") (and the update path)
currently check r.contents for existence but should check r.groupContents (the
volume group snapshot content map) instead; update the existence checks and any
lookups that reference r.contents to use r.groupContents when the object is a
*groupsnapshotv1.VolumeGroupSnapshotContent so the tests get correct
AlreadyExists/version-conflict behavior.

In `@pkg/common-controller/groupsnapshot_controller_helper.go`:
- Around line 1650-1654: The deletion loop in
processGroupSnapshotWithDeletionTimestamp uses context.TODO() which discards
caller cancellation/timeouts; update the Delete calls inside the loop that
iterate over snapshotMembers to pass the existing ctx parameter instead of
context.TODO(), i.e., replace context.TODO() in
ctrl.clientset.SnapshotV1().VolumeSnapshots(...).Delete(...) with the function's
ctx so caller context is propagated.
- Around line 98-102: The code calls
ctrl.clientset.GroupsnapshotV1().VolumeGroupSnapshots(...).UpdateStatus and then
immediately uses the returned newSnapshot in ctrl.eventRecorder.Event without
checking err; if UpdateStatus failed newSnapshot may be nil. Fix by checking err
after UpdateStatus and only use newSnapshot when err == nil; when err != nil
emit the event using the original groupSnapshotClone (or otherwise non-nil
object) and include or record the error; update the block around UpdateStatus,
newSnapshot, err and the ctrl.eventRecorder.Event call to validate err first and
choose the safe object to pass to Event.
- Around line 1406-1407: The current check compares pointer addresses for
ReadyToUse which can differ even when values are equal; change the comparison to
compare the dereferenced boolean values instead: after ensuring
groupSnapshot.Status.ReadyToUse != nil && groupSnapshotContent.Status.ReadyToUse
!= nil, use *groupSnapshot.Status.ReadyToUse !=
*groupSnapshotContent.Status.ReadyToUse (i.e., compare the boolean contents) so
equal true/false values don't trigger unnecessary updates.
- Around line 161-171: The Update error from
ctrl.clientset.GroupsnapshotV1().VolumeGroupSnapshots(...).Update is currently
logged then ignored; change the code in setDefaultGroupSnapshotClass so that if
Update returns a non-nil err you stop processing and return that error (do not
proceed to call storeGroupSnapshotUpdate or return a nil error), and only call
ctrl.storeGroupSnapshotUpdate when newGroupSnapshot is non-nil and Update
succeeded; specifically update the block that calls Update to return the error
(with appropriate zero-value for the VolumeGroupSnapshot return) instead of
continuing to the cache update and returning nil.
- Around line 1552-1554: The condition that checks for an absent content name is
using the address-of operator mistakenly: change the test from using
"&groupSnapshot.Spec.Source.VolumeGroupSnapshotContentName == nil" to directly
comparing the pointer field to nil (i.e.,
"groupSnapshot.Spec.Source.VolumeGroupSnapshotContentName == nil") so the
fallback call to
utils.GetDynamicSnapshotContentNameForGroupSnapshot(groupSnapshot) runs when
groupSnapshotContentName is empty and the Source.VolumeGroupSnapshotContentName
pointer is actually nil; update the conditional around groupSnapshotContentName
and groupSnapshot.Spec.Source.VolumeGroupSnapshotContentName accordingly.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 167c4240-2920-4416-b14b-0ca7a3e18c87

📥 Commits

Reviewing files that changed from the base of the PR and between 77d02e5 and c611294.

⛔ Files ignored due to path filters (191)
  • client/apis/volumegroupsnapshot/v1/zz_generated.deepcopy.go is excluded by !**/zz_generated*
  • client/apis/volumegroupsnapshot/v1beta1/zz_generated.deepcopy.go is excluded by !**/zz_generated*
  • client/apis/volumegroupsnapshot/v1beta2/zz_generated.deepcopy.go is excluded by !**/zz_generated*
  • client/go.sum is excluded by !**/*.sum
  • go.sum is excluded by !**/*.sum
  • vendor/github.com/fsnotify/fsnotify/.cirrus.yml is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fsnotify/fsnotify/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fsnotify/fsnotify/CONTRIBUTING.md is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fsnotify/fsnotify/README.md is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fsnotify/fsnotify/backend_fen.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fsnotify/fsnotify/backend_inotify.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fsnotify/fsnotify/backend_kqueue.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fsnotify/fsnotify/backend_windows.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fsnotify/fsnotify/fsnotify.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fsnotify/fsnotify/internal/darwin.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fsnotify/fsnotify/internal/debug_darwin.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fsnotify/fsnotify/internal/debug_dragonfly.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fsnotify/fsnotify/internal/debug_freebsd.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fsnotify/fsnotify/internal/debug_kqueue.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fsnotify/fsnotify/internal/debug_netbsd.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fsnotify/fsnotify/internal/debug_openbsd.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fsnotify/fsnotify/internal/freebsd.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fsnotify/fsnotify/internal/unix.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fsnotify/fsnotify/internal/unix2.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fsnotify/fsnotify/internal/windows.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fxamacker/cbor/v2/.golangci.yml is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fxamacker/cbor/v2/README.md is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fxamacker/cbor/v2/cache.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fxamacker/cbor/v2/decode.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fxamacker/cbor/v2/decode_map_utils.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fxamacker/cbor/v2/diagnose.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fxamacker/cbor/v2/doc.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fxamacker/cbor/v2/encode.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fxamacker/cbor/v2/simplevalue.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fxamacker/cbor/v2/stream.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fxamacker/cbor/v2/structfields.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fxamacker/cbor/v2/tag.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/fxamacker/cbor/v2/valid.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/jsonpointer/.cliff.toml is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/jsonpointer/.gitignore is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/jsonpointer/.golangci.yml is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/jsonpointer/CODE_OF_CONDUCT.md is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/jsonpointer/CONTRIBUTORS.md is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/jsonpointer/NOTICE is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/jsonpointer/README.md is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/jsonpointer/SECURITY.md is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/jsonpointer/errors.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/jsonpointer/ifaces.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/jsonpointer/options.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/jsonpointer/pointer.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/jsonreference/.cliff.toml is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/jsonreference/.gitignore is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/jsonreference/.golangci.yml is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/jsonreference/CODE_OF_CONDUCT.md is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/jsonreference/CONTRIBUTORS.md is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/jsonreference/NOTICE is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/jsonreference/README.md is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/jsonreference/SECURITY.md is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/jsonreference/reference.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/swag/.gitignore is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/swag/CODE_OF_CONDUCT.md is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/swag/CONTRIBUTORS.md is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/swag/README.md is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/swag/SECURITY.md is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/swag/go.work is excluded by !**/*.work, !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/swag/jsonname/go_name_provider.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/swag/jsonname/ifaces.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/swag/jsonname/name_provider.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/swag/jsonutils/README.md is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/go-openapi/swag/mangling/BENCHMARK.md is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/cel/BUILD.bazel is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/cel/env.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/cel/fieldpaths.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/cel/inlining.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/cel/library.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/cel/options.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/cel/program.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/cel/prompt.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/cel/templates/authoring.tmpl is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/checker/checker.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/checker/cost.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/checker/env.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/checker/options.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/common/ast/ast.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/common/ast/conversion.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/common/decls/decls.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/common/doc.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/common/env/BUILD.bazel is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/common/env/env.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/common/env/io.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/common/overloads/overloads.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/common/stdlib/standard.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/common/types/err.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/common/types/list.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/common/types/object.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/common/types/optional.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/common/types/pb/file.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/common/types/pb/pb.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/common/types/pb/type.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/common/types/provider.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/common/types/ref/provider.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/ext/BUILD.bazel is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/ext/costs.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/ext/formatting.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/ext/formatting_v2.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/ext/lists.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/ext/native.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/ext/regex.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/ext/sets.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/ext/strings.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/interpreter/attributes.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/interpreter/interpretable.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/google/cel-go/parser/parser.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/LICENSE is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/client_metrics.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/client_options.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/constants.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/doc.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/options.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/reporter.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/server_metrics.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/server_options.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/COPYRIGHT is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/LICENSE is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/callmeta.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/client.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/doc.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/reporter.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/server.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-prometheus/.gitignore is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-prometheus/.travis.yml is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-prometheus/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-prometheus/README.md is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-prometheus/client.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-prometheus/client_metrics.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-prometheus/client_reporter.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-prometheus/makefile is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-prometheus/metric_options.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-prometheus/server.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-prometheus/server_metrics.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-prometheus/server_reporter.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/go-grpc-prometheus/util.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/BUILD.bazel is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/handler.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/mux.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/apis/volumegroupsnapshot/v1/doc.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/apis/volumegroupsnapshot/v1/register.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/apis/volumegroupsnapshot/v1/types.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/apis/volumegroupsnapshot/v1/zz_generated.deepcopy.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/apis/volumegroupsnapshot/v1beta1/zz_generated.deepcopy.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/apis/volumegroupsnapshot/v1beta2/zz_generated.deepcopy.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/clientset.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/fake/clientset_generated.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/fake/doc.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/fake/register.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/scheme/doc.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/scheme/register.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1/doc.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1/fake/doc.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1/fake/fake_volumegroupsnapshot.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1/fake/fake_volumegroupsnapshot_client.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1/fake/fake_volumegroupsnapshotclass.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1/fake/fake_volumegroupsnapshotcontent.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1/generated_expansion.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1/volumegroupsnapshot.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1/volumegroupsnapshot_client.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1/volumegroupsnapshotclass.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1/volumegroupsnapshotcontent.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1beta1/doc.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1beta1/fake/doc.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1beta1/fake/fake_volumegroupsnapshot.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1beta1/fake/fake_volumegroupsnapshot_client.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1beta1/fake/fake_volumegroupsnapshotclass.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1beta1/fake/fake_volumegroupsnapshotcontent.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1beta1/generated_expansion.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1beta1/volumegroupsnapshot.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1beta1/volumegroupsnapshot_client.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1beta1/volumegroupsnapshotclass.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1beta1/volumegroupsnapshotcontent.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1beta2/doc.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1beta2/fake/doc.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1beta2/fake/fake_volumegroupsnapshot.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1beta2/fake/fake_volumegroupsnapshot_client.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1beta2/fake/fake_volumegroupsnapshotclass.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1beta2/fake/fake_volumegroupsnapshotcontent.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1beta2/generated_expansion.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1beta2/volumegroupsnapshot.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1beta2/volumegroupsnapshot_client.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1beta2/volumegroupsnapshotclass.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/clientset/versioned/typed/volumegroupsnapshot/v1beta2/volumegroupsnapshotcontent.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/kubernetes-csi/external-snapshotter/client/v8/informers/externalversions/factory.go is excluded by !**/vendor/**, !vendor/**
📒 Files selected for processing (109)
  • CHANGELOG/CHANGELOG-8.6.md
  • client/apis/volumegroupsnapshot/v1/doc.go
  • client/apis/volumegroupsnapshot/v1/register.go
  • client/apis/volumegroupsnapshot/v1/types.go
  • client/clientset/versioned/clientset.go
  • client/clientset/versioned/fake/clientset_generated.go
  • client/clientset/versioned/fake/doc.go
  • client/clientset/versioned/fake/register.go
  • client/clientset/versioned/scheme/doc.go
  • client/clientset/versioned/scheme/register.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1/doc.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1/fake/doc.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1/fake/fake_volumegroupsnapshot.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1/fake/fake_volumegroupsnapshot_client.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1/fake/fake_volumegroupsnapshotclass.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1/fake/fake_volumegroupsnapshotcontent.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1/generated_expansion.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1/volumegroupsnapshot.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1/volumegroupsnapshot_client.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1/volumegroupsnapshotclass.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1/volumegroupsnapshotcontent.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1beta1/doc.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1beta1/fake/doc.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1beta1/fake/fake_volumegroupsnapshot.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1beta1/fake/fake_volumegroupsnapshot_client.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1beta1/fake/fake_volumegroupsnapshotclass.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1beta1/fake/fake_volumegroupsnapshotcontent.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1beta1/generated_expansion.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1beta1/volumegroupsnapshot.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1beta1/volumegroupsnapshot_client.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1beta1/volumegroupsnapshotclass.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1beta1/volumegroupsnapshotcontent.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1beta2/doc.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1beta2/fake/doc.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1beta2/fake/fake_volumegroupsnapshot.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1beta2/fake/fake_volumegroupsnapshot_client.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1beta2/fake/fake_volumegroupsnapshotclass.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1beta2/fake/fake_volumegroupsnapshotcontent.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1beta2/generated_expansion.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1beta2/volumegroupsnapshot.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1beta2/volumegroupsnapshot_client.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1beta2/volumegroupsnapshotclass.go
  • client/clientset/versioned/typed/volumegroupsnapshot/v1beta2/volumegroupsnapshotcontent.go
  • client/config/crd/groupsnapshot.storage.k8s.io_volumegroupsnapshotclasses.yaml
  • client/config/crd/groupsnapshot.storage.k8s.io_volumegroupsnapshotcontents.yaml
  • client/config/crd/groupsnapshot.storage.k8s.io_volumegroupsnapshots.yaml
  • client/go.mod
  • client/hack/boilerplate.go.txt
  • client/informers/externalversions/factory.go
  • client/informers/externalversions/generic.go
  • client/informers/externalversions/internalinterfaces/factory_interfaces.go
  • client/informers/externalversions/volumegroupsnapshot/interface.go
  • client/informers/externalversions/volumegroupsnapshot/v1/interface.go
  • client/informers/externalversions/volumegroupsnapshot/v1/volumegroupsnapshot.go
  • client/informers/externalversions/volumegroupsnapshot/v1/volumegroupsnapshotclass.go
  • client/informers/externalversions/volumegroupsnapshot/v1/volumegroupsnapshotcontent.go
  • client/informers/externalversions/volumegroupsnapshot/v1beta1/interface.go
  • client/informers/externalversions/volumegroupsnapshot/v1beta1/volumegroupsnapshot.go
  • client/informers/externalversions/volumegroupsnapshot/v1beta1/volumegroupsnapshotclass.go
  • client/informers/externalversions/volumegroupsnapshot/v1beta1/volumegroupsnapshotcontent.go
  • client/informers/externalversions/volumegroupsnapshot/v1beta2/interface.go
  • client/informers/externalversions/volumegroupsnapshot/v1beta2/volumegroupsnapshot.go
  • client/informers/externalversions/volumegroupsnapshot/v1beta2/volumegroupsnapshotclass.go
  • client/informers/externalversions/volumegroupsnapshot/v1beta2/volumegroupsnapshotcontent.go
  • client/listers/volumegroupsnapshot/v1/expansion_generated.go
  • client/listers/volumegroupsnapshot/v1/volumegroupsnapshot.go
  • client/listers/volumegroupsnapshot/v1/volumegroupsnapshotclass.go
  • client/listers/volumegroupsnapshot/v1/volumegroupsnapshotcontent.go
  • client/listers/volumegroupsnapshot/v1beta1/expansion_generated.go
  • client/listers/volumegroupsnapshot/v1beta1/volumegroupsnapshot.go
  • client/listers/volumegroupsnapshot/v1beta1/volumegroupsnapshotclass.go
  • client/listers/volumegroupsnapshot/v1beta1/volumegroupsnapshotcontent.go
  • client/listers/volumegroupsnapshot/v1beta2/expansion_generated.go
  • client/listers/volumegroupsnapshot/v1beta2/volumegroupsnapshot.go
  • client/listers/volumegroupsnapshot/v1beta2/volumegroupsnapshotclass.go
  • client/listers/volumegroupsnapshot/v1beta2/volumegroupsnapshotcontent.go
  • cmd/csi-snapshotter/main.go
  • cmd/snapshot-controller/main.go
  • deploy/kubernetes/csi-snapshotter/setup-csi-snapshotter.yaml
  • deploy/kubernetes/snapshot-controller/setup-snapshot-controller.yaml
  • go.mod
  • pkg/common-controller/framework_test.go
  • pkg/common-controller/groupsnapshot_controller_helper.go
  • pkg/common-controller/groupsnapshot_create_test.go
  • pkg/common-controller/groupsnapshot_helper_test.go
  • pkg/common-controller/groupsnapshot_sync_test.go
  • pkg/common-controller/snapshot_controller.go
  • pkg/common-controller/snapshot_controller_base.go
  • pkg/common-controller/snapshot_delete_test.go
  • pkg/group_snapshotter/group_snapshotter_test.go
  • pkg/metrics/metrics.go
  • pkg/metrics/metrics_test.go
  • pkg/sidecar-controller/csi_handler.go
  • pkg/sidecar-controller/csi_handler_test.go
  • pkg/sidecar-controller/framework_test.go
  • pkg/sidecar-controller/groupsnapshot_controller_test.go
  • pkg/sidecar-controller/groupsnapshot_helper.go
  • pkg/sidecar-controller/groupsnapshot_helper_test.go
  • pkg/sidecar-controller/snapshot_controller_base.go
  • pkg/utils/patch.go
  • pkg/utils/util.go
  • pkg/utils/vgs.go
  • pkg/utils/vgs_test.go
  • pkg/webhook/webhook.go
  • release-tools/.github/workflows/codespell.yml
  • release-tools/.github/workflows/trivy.yaml
  • release-tools/cloudbuild.yaml
  • release-tools/prow.sh
  • release-tools/verify-vendor.sh

Comment on lines +355 to +358
// CreationTime is the timestamp when the point-in-time group snapshot is taken
// by the underlying storage system.
// If not specified, it indicates the creation time is unknown.
// If not specified, it means the readiness of a group snapshot is unknown.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Remove misplaced readiness comment from CreationTime documentation.

Line 358 incorrectly states "If not specified, it means the readiness of a group snapshot is unknown" within the CreationTime field documentation. This comment describes the ReadyToUse field behavior, not creation time. It should be removed from this location.

📝 Proposed fix
 // CreationTime is the timestamp when the point-in-time group snapshot is taken
 // by the underlying storage system.
 // If not specified, it indicates the creation time is unknown.
-// If not specified, it means the readiness of a group snapshot is unknown.
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
// CreationTime is the timestamp when the point-in-time group snapshot is taken
// by the underlying storage system.
// If not specified, it indicates the creation time is unknown.
// If not specified, it means the readiness of a group snapshot is unknown.
// CreationTime is the timestamp when the point-in-time group snapshot is taken
// by the underlying storage system.
// If not specified, it indicates the creation time is unknown.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@client/apis/volumegroupsnapshot/v1/types.go` around lines 355 - 358, Remove
the misplaced readiness comment from the CreationTime field documentation:
locate the CreationTime docstring in client/apis/volumegroupsnapshot/v1/types.go
and delete the sentence "If not specified, it means the readiness of a group
snapshot is unknown" (this belongs to ReadyToUse), leaving only the
creation-time related comments; ensure ReadyToUse's documentation contains the
readiness note instead.

Comment thread client/go.mod
go 1.22.0

toolchain go1.22.3
go 1.25.8

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Check declared Go versions across the repository

echo "=== Checking go.mod files ==="
fd -e mod -x grep -H "^go " {}

echo -e "\n=== Checking Dockerfiles ==="
fd Dockerfile -x grep -H "FROM.*golang:" {} || echo "No Dockerfile golang references found"

echo -e "\n=== Checking GitHub Actions ==="
fd -e yml -e yaml . .github/workflows -x grep -H "go-version" {} || echo "No go-version in workflows"

echo -e "\n=== Checking tool-versions files ==="
fd -t f "tool-versions|go-version" -x cat {} || echo "No .tool-versions or .go-version found"

Repository: openshift/csi-external-snapshotter

Length of output: 1998


🌐 Web query:

Has Go version 1.25.8 been released as of June 2026?

💡 Result:

Yes, Go version 1.25.8 was released prior to June 2026 [1][2]. It was a minor point release that included security fixes [1]. As of June 9, 2026, the Go project has since released further updates, with the most recent versions being 1.26.4 and 1.25.11 [3][4].

Citations:


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== client/go.mod ==="
nl -ba client/go.mod | sed -n '1,120p'

echo -e "\n=== root go.mod ==="
nl -ba go.mod | sed -n '1,80p'

echo -e "\n=== Search for Go version pins in repo ==="
rg -n --hidden --glob '!.git/*' \
  "1\.25\.8|go1\.25\.8|1\.26\.0|go-version|tool-versions|\.go-version|CSI_PROW_GO_VERSION_BUILD" .

echo -e "\n=== List CI config locations (top-level) ==="
ls -la . || true
ls -la .github || true
ls -la .github/workflows || true
ls -la prow || true
ls -la .circleci || true
ls -la .buildkite || true

Repository: openshift/csi-external-snapshotter

Length of output: 161


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== client/go.mod (first 120 lines) ==="
cat -n client/go.mod | sed -n '1,120p'

echo -e "\n=== root go.mod (first 80 lines) ==="
cat -n go.mod | sed -n '1,80p'

echo -e "\n=== Search for Go version pins in repo ==="
rg -n --hidden --glob '!.git/*' \
  "1\.25\.8|go1\.25\.8|1\.26\.0|go-version|tool-versions|\.go-version|CSI_PROW_GO_VERSION_BUILD" .

echo -e "\n=== List CI config locations (top-level) ==="
ls -la . || true
ls -la .github || true
ls -la .github/workflows || true
ls -la .circleci || true
ls -la .buildkite || true
ls -la prow || true

Repository: openshift/csi-external-snapshotter

Length of output: 20710


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== release-tools/prow.sh: CSI_PROW_GO_VERSION_BUILD ==="
rg -n "configvar CSI_PROW_GO_VERSION_BUILD" release-tools/prow.sh
sed -n '70,110p' release-tools/prow.sh

echo -e "\n=== release-tools/verify-go-version.sh ==="
nl -ba release-tools/verify-go-version.sh | sed -n '1,140p'

echo -e "\n=== release-tools/build.make check-go-version-go ==="
rg -n "check-go-version-go" release-tools/build.make
sed -n '280,340p' release-tools/build.make

echo -e "\n=== release-tools/ .github workflow referencing go-version ==="
ls -la release-tools/.github/workflows || true
rg -n "GO_VERSION|go-version|CSI_PROW_GO_VERSION_BUILD" release-tools/.github/workflows -S
sed -n '1,120p' release-tools/.github/workflows/trivy.yaml

Repository: openshift/csi-external-snapshotter

Length of output: 2989


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== release-tools/verify-go-version.sh (first 220 lines) ==="
cat -n release-tools/verify-go-version.sh | sed -n '1,220p'

echo -e "\n=== release-tools/build.make: check-go-version-go target ==="
rg -n "check-go-version-go" release-tools/build.make
sed -n '260,360p' release-tools/build.make

echo -e "\n=== release-tools/.github/workflows/trivy.yaml (first 160 lines) ==="
ls -la release-tools/.github || true
ls -la release-tools/.github/workflows || true
sed -n '1,160p' release-tools/.github/workflows/trivy.yaml

echo -e "\n=== Any references to go-version elsewhere in release-tools workflows ==="
rg -n "go-version|GO_VERSION|CSI_PROW_GO_VERSION_BUILD" release-tools/.github/workflows -S

Repository: openshift/csi-external-snapshotter

Length of output: 6248


🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n "^[[:space:]]*configvar[[:space:]]+CSI_PROW_GO_VERSION_BUILD|function configvar|configvar \\(" release-tools/prow.sh
rg -n "configvar \\(" release-tools/prow.sh | head -n 50
rg -n "CSI_PROW_GO_VERSION_BUILD" release-tools/prow.sh

# Show configvar implementation area (first ~120 lines)
sed -n '1,140p' release-tools/prow.sh

Repository: openshift/csi-external-snapshotter

Length of output: 8506


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== Locate .go-version / .tool-versions ==="
fd -a -t f '(\.go-version|\.tool-versions|go-version)$' . || true
fd -a -t f 'tool-versions|go-version' . -x sed -n '1,5p' {} || true

echo -e "\n=== Search for golang: images / go-version pins ==="
rg -n --hidden --glob '!.git/*' \
  "FROM\s+golang:|golang:1\.2[0-9]|go-version:|go-version\s*=|go-version\s+\"|GO_VERSION|CSI_PROW_GO_VERSION_BUILD|1\.25\." .

echo -e "\n=== Search for release-tools Dockerfiles ==="
fd -e Dockerfile . | head -n 50 || true
rg -n --hidden --glob '!.git/*' "FROM.*golang:" . || true

Repository: openshift/csi-external-snapshotter

Length of output: 9049


Align Go version directive with CI toolchain (client/go.mod go 1.25.8)

Go 1.25.8 exists, but this repo’s build tooling pins Go 1.26.3 (release-tools/prow.sh CSI_PROW_GO_VERSION_BUILD) and the root module uses go 1.26.0; only client/go.mod specifies go 1.25.8. Update client/go.mod to 1.26.x or document why the client module intentionally targets 1.25.x.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@client/go.mod` at line 3, Update the Go version directive in client/go.mod
from "go 1.25.8" to match the repo/tooling (use "go 1.26.3" or at least "go
1.26.0") so it aligns with CSI_PROW_GO_VERSION_BUILD and the root module; edit
the go directive in client/go.mod accordingly or add a short comment in the
module explaining an intentional difference if you must remain at 1.25.x.

Comment on lines +145 to +161
t.Run("makeGroupSnapshotName with UUIDLength -1", func(t *testing.T) {
h := NewCSIHandler(nil, &fakeGroupSnapshotter{}, 5*time.Second, "snap", 8, "grp-snap", -1)
content := &groupsnapshotv1.VolumeGroupSnapshotContent{
ObjectMeta: metav1.ObjectMeta{Name: "gsc-5"},
Spec: groupsnapshotv1.VolumeGroupSnapshotContentSpec{
VolumeGroupSnapshotRef: corev1.ObjectReference{UID: "my-uid-with-dashes"},
Source: groupsnapshotv1.VolumeGroupSnapshotContentSource{VolumeHandles: []string{"vol-1"}},
},
}
_, groupID, _, _, _, err := h.CreateGroupSnapshot(content, nil, nil)
if err != nil {
t.Fatalf("CreateGroupSnapshot failed: %v", err)
}
if groupID != "group-snap-id" {
t.Errorf("unexpected groupID: %q", groupID)
}
})

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

The UUID-length subtest does not verify the generated snapshot name.

This subtest currently checks groupID, which comes from the fake response, so it can pass even if groupSnapshotNameUUIDLength = -1 logic is broken.

Suggested fix
 type fakeGroupSnapshotter struct {
 	createGroupSnapshotResult func() (driverName, groupSnapshotID string, snapshots []*csi.Snapshot, timestamp time.Time, readyToUse bool, err error)
 	deleteGroupSnapshotErr    error
 	getGroupSnapshotStatus    func() (readyToUse bool, timestamp time.Time, err error)
+	lastCreateName            string
 }
 
 func (f *fakeGroupSnapshotter) CreateGroupSnapshot(ctx context.Context, groupSnapshotName string, volumeIDs []string, parameters map[string]string, snapshotterCredentials map[string]string) (string, string, []*csi.Snapshot, time.Time, bool, error) {
+	f.lastCreateName = groupSnapshotName
 	if f.createGroupSnapshotResult != nil {
 		return f.createGroupSnapshotResult()
 	}
 	return "driver", "group-snap-id", nil, time.Now(), true, nil
 }
@@
 	t.Run("makeGroupSnapshotName with UUIDLength -1", func(t *testing.T) {
-		h := NewCSIHandler(nil, &fakeGroupSnapshotter{}, 5*time.Second, "snap", 8, "grp-snap", -1)
+		fake := &fakeGroupSnapshotter{}
+		h := NewCSIHandler(nil, fake, 5*time.Second, "snap", 8, "grp-snap", -1)
@@
-		if groupID != "group-snap-id" {
-			t.Errorf("unexpected groupID: %q", groupID)
+		if fake.lastCreateName != "grp-snap-my-uid-with-dashes" {
+			t.Errorf("unexpected generated group snapshot name: %q", fake.lastCreateName)
 		}
 	})
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/sidecar-controller/csi_handler_test.go` around lines 145 - 161, The test
is missing an assertion for the generated snapshot name; update the subtest so
after calling h.CreateGroupSnapshot you also assert the first return value
(snapshotName) equals the expected deterministic name when
groupSnapshotNameUUIDLength is -1 (i.e., no UUID suffix). Locate the call to
NewCSIHandler(...) and the CreateGroupSnapshot(...) invocation in the test and
add a check that the returned snapshotName (the first returned value) matches
the expected name for prefix "grp-snap" with UUIDLength -1 (ensure the test
fails if a UUID suffix is present).

Comment on lines +66 to +69
VolumeGroupSnapshotRef: v1.ObjectReference{
Kind: "VolumeGroupSnapshot",
APIVersion: "groupsnapshot.storage.k8s.io/v1beta2",
UID: types.UID(boundToGroupSnapshotUID),

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Use groupsnapshot.storage.k8s.io/v1 in the v1 test fixture.

newGroupSnapshotContent still hardcodes APIVersion: "groupsnapshot.storage.k8s.io/v1beta2", which is inconsistent with this v1 migration and can hide version-contract regressions in tests.

Suggested fix
-				APIVersion: "groupsnapshot.storage.k8s.io/v1beta2",
+				APIVersion: "groupsnapshot.storage.k8s.io/v1",
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
VolumeGroupSnapshotRef: v1.ObjectReference{
Kind: "VolumeGroupSnapshot",
APIVersion: "groupsnapshot.storage.k8s.io/v1beta2",
UID: types.UID(boundToGroupSnapshotUID),
VolumeGroupSnapshotRef: v1.ObjectReference{
Kind: "VolumeGroupSnapshot",
APIVersion: "groupsnapshot.storage.k8s.io/v1",
UID: types.UID(boundToGroupSnapshotUID),
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/sidecar-controller/groupsnapshot_controller_test.go` around lines 66 -
69, Update the test fixture to use the v1 API version consistently: locate the
newGroupSnapshotContent test helper (and any creation of VolumeGroupSnapshotRef)
and change its hardcoded APIVersion from "groupsnapshot.storage.k8s.io/v1beta2"
to "groupsnapshot.storage.k8s.io/v1" so the v1 test fixture and the created
GroupSnapshotContent objects use the same API version and avoid hiding
version-contract regressions.

contentCopy := test.content.DeepCopy()
client := fake.NewSimpleClientset(contentCopy)
store := cache.NewStore(cache.DeletionHandlingMetaNamespaceKeyFunc)
_ = store.Add(contentCopy)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Stop ignoring Add(...) errors in test setup.

There are multiple _ = <store/indexer>.Add(...) calls. If any setup insertion fails, tests can produce misleading outcomes.

As per coding guidelines: **/*.go: "Never ignore error returns".

Also applies to: 743-743, 766-766, 867-867, 1054-1054, 1085-1085, 1120-1120, 1146-1147, 1414-1414, 1417-1417

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/sidecar-controller/groupsnapshot_controller_test.go` at line 444, The
test setup currently ignores errors from store.Add(contentCopy) (and other
similar _ = store.Add(...) calls); update each Add(...) invocation to check the
returned error and fail the test on error (e.g., if err :=
store.Add(contentCopy); err != nil { t.Fatalf("store.Add failed: %v", err) } or
use require.NoError(t, err)). Replace all occurrences of ignored Add calls
(store.Add) in groupsnapshot_controller_test.go so setup insertion failures
surface immediately instead of being silently ignored.

Source: Coding guidelines

v1.VolumeSnapshotContentDelete, nil, false, nil,
)
classIndexer := cache.NewIndexer(cache.MetaNamespaceKeyFunc, cache.Indexers{})
_ = classIndexer.Add(newVolumeGroupSnapshotClass("class-a", mockDriverName))

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Handle Add(...) errors explicitly in test setup.

These ignored errors can silently invalidate test preconditions and make failures harder to diagnose.

As per coding guidelines: **/*.go: "Never ignore error returns".

Also applies to: 145-145, 184-184, 320-320, 355-355, 387-387

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/sidecar-controller/groupsnapshot_helper_test.go` at line 114, Test setup
is silently ignoring errors from
classIndexer.Add(newVolumeGroupSnapshotClass(...)), which can hide failing
preconditions; update each call to classIndexer.Add (e.g., the usages that call
newVolumeGroupSnapshotClass("class-a", mockDriverName) and the other instances
noted) to check the returned error and fail the test immediately (t.Fatalf or
require.NoError) if non-nil so test setup errors are explicit and cause test
failure rather than being ignored.

Source: Coding guidelines

@jsafrane

Copy link
Copy Markdown

/retest

@jsafrane

Copy link
Copy Markdown

/lgtm
/approve
/verified by CI

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Jun 10, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@jsafrane: This PR has been marked as verified by CI.

Details

In response to this:

/lgtm
/approve
/verified by CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jun 10, 2026
@openshift-ci

openshift-ci Bot commented Jun 10, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jsafrane, rvagner78

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 10, 2026
@openshift-merge-bot

Copy link
Copy Markdown

/retest-required

Remaining retests: 0 against base HEAD 9cdd51a and 2 for PR HEAD 151ed79 in total

@openshift-ci

openshift-ci Bot commented Jun 10, 2026

Copy link
Copy Markdown

@rvagner78: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-merge-bot openshift-merge-bot Bot merged commit cab9af9 into openshift:master Jun 10, 2026
11 checks passed
redhat-chai-bot pushed a commit to redhat-chai-bot/csi-external-snapshotter that referenced this pull request Jun 11, 2026
This reverts merge commit cab9af9 (PR openshift#219).

The v8.6.0 rebase changed the snapshot-controller to require VolumeGroupSnapshot
CRDs at startup when CSIVolumeGroupSnapshot=true. In HyperShift hosted clusters,
CRDs are installed asynchronously in the guest cluster, creating a race condition
that causes 6-7 crash-loop restarts of csi-snapshot-controller.

This broke payload 5.0.0-0.ci-2026-06-11-001513 (hypershift-e2e-aks and
hypershift-e2e-aws both at 100% failure rate).
rvagner78 added a commit to rvagner78/csi-external-snapshotter that referenced this pull request Jun 16, 2026
This reverts commit 56ba1dc, which
reverted the original v8.6.0 rebase (PR openshift#219).

The original revert was caused by a VolumeGroupSnapshot CRD API version
incompatibility that triggered crash-loop restarts in HyperShift hosted
clusters. That incompatibility is now fixed, making it safe to re-land
the v8.6.0 rebase.

release-tools/ changes are excluded and handled in a separate subtree merge.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. verified Signifies that the PR passed pre-merge verification criteria

Projects

None yet

Development

Successfully merging this pull request may close these issues.