OCPBUGS-83863: Remove RHEL 8 binary build, strip debug info by sdodson · Pull Request #3149 · openshift/ovn-kubernetes

sdodson · 2026-04-21T16:30:42Z

Remove the rhel8 build stage, apply LDFLAGS to all binaries, and strip debug symbols.

The rhel9/rhel10 version-specific subdirectories are no longer needed
since openshift/cluster-network-operator#2967 removed the OS detection
logic and now copies ovn-k8s-cni-overlay directly from /usr/libexec/cni/.

Summary by CodeRabbit

Chores
- Optimized build process to produce smaller binary sizes through binary stripping.
- Removed RHEL-8 build stage and associated artifacts; RHEL-9 remains supported.
- Standardized build flags application across all binary builds for consistency.

openshift-ci-robot · 2026-04-21T16:30:49Z

@sdodson: This pull request references Jira Issue OCPBUGS-83870, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

Remove the rhel8 multi-stage build that compiled a second set of binaries with the RHEL 8 Go toolchain

Remove RHEL 8 shim copies (/usr/libexec/cni/rhel8/ovn-k8s-cni-overlay, /usr/lib/rhel8/ovnkube-trace) from the final image

Retain the rhel9/ directory structure so future RHEL versions (10, 11) can be added by introducing a new build stage

Test plan

Verify the image builds successfully without the rhel8 stage

Verify RHEL 9 nodes get the correct CNI shim from /usr/libexec/cni/rhel9/

Confirm no RHEL 8 nodes remain in supported clusters

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-04-21T16:31:00Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Enterprise

Run ID: 9f414158-8b01-4fc0-a519-f069fc5e6bda

📥 Commits

Reviewing files that changed from the base of the PR and between f0b23c7 and 0354c41.

📒 Files selected for processing (2)

Dockerfile
go-controller/hack/build-go.sh

Walkthrough

Removed the RHEL‑8 build stage and RHEL‑8 artifact copies from the Dockerfile. The builder now adds LDFLAGS="-w -s" to built binaries. The build script unconditionally appends ${LDFLAGS} to -ldflags for native and Windows builds; final image no longer installs RHEL‑8-specific shims or ovnkube-trace.

Changes

Dockerfile and build script

Layer / File(s)	Summary
Builder: go-controller LDFLAGS and rhel8 stage removal `Dockerfile`	Builder stage now builds go-controller with stripped linker flags (`LDFLAGS="-w -s"`); dedicated `rhel8` build stage removed.
Final image CNI/shim cleanup `Dockerfile`	Removed final-stage creation/copying of `/usr/libexec/cni/rhel8` artifacts and the `ovnkube-trace` RHEL‑8 install steps.
Build script: unconditional LDFLAGS `go-controller/hack/build-go.sh`	Replaced conditional command-substitution so `${LDFLAGS}` is appended unconditionally to `-ldflags` for native and Windows binary builds.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Suggested reviewers

martinkennelly

Poem

🐰 I nibbled stage eight from the stack,
Linked flags in place, no turning back.
One build to rule the final scene,
Binaries trimmed and running lean.
Hop on — the pipeline's clean! 🥕

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically summarizes the main changes: removing RHEL 8 binary build and stripping debug info, which directly aligns with the primary objectives of the PR.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

openshift-ci-robot · 2026-04-21T16:31:22Z

@sdodson: This pull request references Jira Issue OCPBUGS-83870, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

Summary

Remove the rhel8 multi-stage build that compiled a second set of binaries with the RHEL 8 Go toolchain

Remove RHEL 8 shim copies (/usr/libexec/cni/rhel8/ovn-k8s-cni-overlay, /usr/lib/rhel8/ovnkube-trace) from the final image

Retain the rhel9/ directory structure so future RHEL versions (10, 11) can be added by introducing a new build stage

Test plan

Verify the image builds successfully without the rhel8 stage

Verify RHEL 9 nodes get the correct CNI shim from /usr/libexec/cni/rhel9/

Confirm no RHEL 8 nodes remain in supported clusters

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores

Removed RHEL-8 binary support from the container image. The image now exclusively includes RHEL-9 components, streamlining the build process.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-04-21T20:12:16Z

@sdodson: This pull request references Jira Issue OCPBUGS-83868, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

Remove the rhel8 multi-stage build that compiled a second set of binaries with the RHEL 8 Go toolchain

Remove RHEL 8 shim copies (/usr/libexec/cni/rhel8/ovn-k8s-cni-overlay, /usr/lib/rhel8/ovnkube-trace) from the final image

Retain the rhel9/ directory structure so future RHEL versions (10, 11) can be added by introducing a new build stage

Test plan

Verify the image builds successfully without the rhel8 stage

Verify RHEL 9 nodes get the correct CNI shim from /usr/libexec/cni/rhel9/

Confirm no RHEL 8 nodes remain in supported clusters

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores

Removed RHEL‑8 runtime artifacts and shim binaries from the container image; the final image now contains only RHEL‑9 components.

Simplified the build output and packaging so only RHEL‑9-built binaries are included, reducing image contents and streamlining the build pipeline.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-04-21T20:12:29Z

@sdodson: This pull request references Jira Issue OCPBUGS-83863, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

Remove the rhel8 multi-stage build that compiled a second set of binaries with the RHEL 8 Go toolchain

Remove RHEL 8 shim copies (/usr/libexec/cni/rhel8/ovn-k8s-cni-overlay, /usr/lib/rhel8/ovnkube-trace) from the final image

Retain the rhel9/ directory structure so future RHEL versions (10, 11) can be added by introducing a new build stage

Test plan

Verify the image builds successfully without the rhel8 stage

Verify RHEL 9 nodes get the correct CNI shim from /usr/libexec/cni/rhel9/

Confirm no RHEL 8 nodes remain in supported clusters

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores

Removed RHEL‑8 runtime artifacts and shim binaries from the container image; the final image now contains only RHEL‑9 components.

Simplified the build output and packaging so only RHEL‑9-built binaries are included, reducing image contents and streamlining the build pipeline.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

sdodson · 2026-04-21T20:55:29Z

/hold
Need to test all of these together

Drop OS detection and version-specific directory probing from both cnibincopy scripts (multus.yaml and 008-script-lib.yaml) entirely. multus.yaml: - Consolidate RHEL8_SOURCE_DIRECTORY, RHEL9_SOURCE_DIRECTORY, and DEFAULT_SOURCE_DIRECTORY env vars into a single SOURCE_DIRECTORY - Remove os-release host volume mount from all cnibincopy init containers and the multus DaemonSet - Binaries are now copied directly from the default paths (e.g. /usr/src/multus-cni/bin/, /bondcni/, /usr/src/plugins/bin/) 008-script-lib.yaml (OVN): - Remove os-release sourcing and RHEL version case statements - Copy ovn-k8s-cni-overlay directly from /usr/libexec/cni/ This unblocks removing rhel8 build stages from upstream images (openshift/ovn-kubernetes#3149, openshift/multus-cni#285). By the time version-specific paths would be needed again (RHEL 11+), all in-cluster components will use native FIPS, making this logic permanently unnecessary. rh-pre-commit.version: 2.4.0 rh-pre-commit.check-secrets: ENABLED

openshift-ci · 2026-05-23T16:50:48Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sdodson
Once this PR has been reviewed and has the lgtm label, please assign martinkennelly for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

…ectories The version-specific CNI directories (rhel8/, rhel9/) are no longer needed since cluster-network-operator#2967 removed the OS detection logic and now copies ovn-k8s-cni-overlay directly. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> rh-pre-commit.version: 2.4.0 rh-pre-commit.check-secrets: ENABLED

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> rh-pre-commit.version: 2.4.0 rh-pre-commit.check-secrets: ENABLED

sdodson · 2026-05-23T20:35:07Z

/testwith openshift/ovn-kubernetes/master/e2e-aws-ovn openshift/bond-cni#113 openshift/route-override-cni#66 openshift/egress-router-cni#100 openshift/containernetworking-plugins#228 openshift/whereabouts-cni#405 openshift/multus-cni#285

openshift-ci · 2026-05-23T20:35:13Z

@sdodson, testwith: could not generate prow job. ERROR:

could not determine ci op config from metadata: got unexpected http 404 status code from configresolver: failed to get config: could not find any config for branch master on repo openshift/ovn-kubernetes

sdodson · 2026-05-23T20:35:51Z

/testwith e2e-aws-ovn openshift/bond-cni#113 openshift/route-override-cni#66 openshift/egress-router-cni#100 openshift/containernetworking-plugins#228 openshift/whereabouts-cni#405 openshift/multus-cni#285

openshift-ci · 2026-05-23T20:35:55Z

@sdodson, testwith: Error processing request. ERROR:

could not determine job runs: requested job is invalid. needs to be formatted like: <org>/<repo>/<branch>/<variant?>/<job>. instead it was: e2e-aws-ovn

sdodson · 2026-05-23T20:36:12Z

/testwith openshift/ovn-kubernetes/e2e-aws-ovn openshift/bond-cni#113 openshift/route-override-cni#66 openshift/egress-router-cni#100 openshift/containernetworking-plugins#228 openshift/whereabouts-cni#405 openshift/multus-cni#285

openshift-ci · 2026-05-23T20:36:15Z

@sdodson, testwith: Error processing request. ERROR:

could not determine job runs: requested job is invalid. needs to be formatted like: <org>/<repo>/<branch>/<variant?>/<job>. instead it was: openshift/ovn-kubernetes/e2e-aws-ovn

sdodson · 2026-05-23T20:37:06Z

/testwith openshift/ovn-kubernetes/main/e2e-aws-ovn openshift/bond-cni#113 openshift/route-override-cni#66 openshift/egress-router-cni#100 openshift/containernetworking-plugins#228 openshift/whereabouts-cni#405 openshift/multus-cni#285

sdodson · 2026-05-23T20:38:15Z

/testwith openshift/ovn-kubernetes/main/e2e-aws-ovn-serial openshift/bond-cni#113 openshift/route-override-cni#66 openshift/egress-router-cni#100 openshift/containernetworking-plugins#228 openshift/whereabouts-cni#405 openshift/multus-cni#285

sdodson · 2026-05-23T20:38:47Z

/testwith openshift/ovn-kubernetes/main/5.0-upgrade-from-stable-4.22-e2e-aws-ovn-upgrade openshift/bond-cni#113 openshift/route-override-cni#66 openshift/egress-router-cni#100 openshift/containernetworking-plugins#228 openshift/whereabouts-cni#405 openshift/multus-cni#285

openshift-ci · 2026-05-23T20:38:52Z

@sdodson, testwith: could not generate prow job. ERROR:

BUG: test '5.0-upgrade-from-stable-4.22-e2e-aws-ovn-upgrade' not found in injected config

Drop OS detection and version-specific directory probing from both cnibincopy scripts (multus.yaml and 008-script-lib.yaml) entirely. multus.yaml: - Consolidate RHEL8_SOURCE_DIRECTORY, RHEL9_SOURCE_DIRECTORY, and DEFAULT_SOURCE_DIRECTORY env vars into a single SOURCE_DIRECTORY - Remove os-release host volume mount from all cnibincopy init containers and the multus DaemonSet - Binaries are now copied directly from the default paths (e.g. /usr/src/multus-cni/bin/, /bondcni/, /usr/src/plugins/bin/) 008-script-lib.yaml (OVN): - Remove os-release sourcing and RHEL version case statements - Copy ovn-k8s-cni-overlay directly from /usr/libexec/cni/ This unblocks removing rhel8 build stages from upstream images (openshift/ovn-kubernetes#3149, openshift/multus-cni#285). By the time version-specific paths would be needed again (RHEL 11+), all in-cluster components will use native FIPS, making this logic permanently unnecessary. rh-pre-commit.version: 2.4.0 rh-pre-commit.check-secrets: ENABLED

sdodson · 2026-06-09T17:38:52Z

/hold cancel

sdodson · 2026-06-09T17:38:57Z

/retest-required

sdodson · 2026-06-10T16:43:25Z

Ahh, all those failures are leftovers about 4.22. Maybe this will clear them out of the summary report.
/skip

sdodson · 2026-06-10T17:50:19Z

/test e2e-aws-ovn-edge-zones

openshift-ci · 2026-06-10T22:02:09Z

@sdodson: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-rt-upgrade	`0354c41`	link	true	`/test 4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-rt-upgrade`
ci/prow/security	`0354c41`	link	false	`/test security`
ci/prow/4.22-upgrade-from-stable-4.21-e2e-aws-ovn-upgrade	`0354c41`	link	true	`/test 4.22-upgrade-from-stable-4.21-e2e-aws-ovn-upgrade`
ci/prow/4.22-upgrade-from-stable-4.21-e2e-aws-ovn-upgrade-ipsec	`0354c41`	link	false	`/test 4.22-upgrade-from-stable-4.21-e2e-aws-ovn-upgrade-ipsec`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

sdodson · 2026-07-14T16:28:30Z

/test e2e-aws-ovn-edge-zones
looks like that job was broken for a long time and since fixed

kyrtapz · 2026-07-15T11:01:57Z

                -X ${OVN_KUBE_GO_PACKAGE}/pkg/config.BuildDate=${BUILD_DATE} \
                -X k8s.io/client-go/pkg/version.gitVersion=${K8S_CLIENT_VERSION} \
-		`if [ "$binbase" != "ovnkube" ]; then echo ${LDFLAGS}; fi`" \
+		${LDFLAGS}" \


This commit description doesn't match its content, debug/symbol stripping actually happened in the previous commit. Mind squashing the two, and adding a short rationale for stripping symbols from all binaries?

openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels Apr 21, 2026

openshift-ci Bot requested review from martinkennelly and tssurya April 21, 2026 16:32

sdodson force-pushed the el9-only branch from 877b025 to 32e1be3 Compare April 21, 2026 18:22

sdodson changed the title ~~OCPBUGS-83870: Remove RHEL 8 binary build from Dockerfile~~ OCPBUGS-83868: Remove RHEL 8 binary build from Dockerfile Apr 21, 2026

openshift-ci-robot added the jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. label Apr 21, 2026

sdodson changed the title ~~OCPBUGS-83868: Remove RHEL 8 binary build from Dockerfile~~ OCPBUGS-83863: Remove RHEL 8 binary build from Dockerfile Apr 21, 2026

openshift-ci-robot removed the jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. label Apr 21, 2026

sdodson mentioned this pull request Apr 21, 2026

OCPBUGS-83863: Remove version-specific CNI binary copy logic openshift/cluster-network-operator#2967

Merged

3 tasks

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Apr 21, 2026

sdodson force-pushed the el9-only branch from e9d510d to f0b23c7 Compare April 28, 2026 20:03

openshift-ci-robot mentioned this pull request May 2, 2026

OCPBUGS-83868: prevent IAM resource leaks during cluster destroy openshift/hypershift#8303

Merged

4 tasks

sdodson force-pushed the el9-only branch from f0b23c7 to d1499aa Compare May 23, 2026 16:49

sdodson changed the title ~~OCPBUGS-83863: Remove RHEL 8 binary build from Dockerfile~~ OCPBUGS-83863: Remove RHEL 8 binary build, strip debug info May 23, 2026

sdodson added 2 commits May 23, 2026 13:53

OCPBUGS-83863: Strip debug info and symbol table from binaries

0354c41

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> rh-pre-commit.version: 2.4.0 rh-pre-commit.check-secrets: ENABLED

sdodson force-pushed the el9-only branch from d1499aa to 0354c41 Compare May 23, 2026 17:56

openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 9, 2026

kyrtapz reviewed Jul 15, 2026

View reviewed changes

openshift-ci-robot mentioned this pull request Jul 20, 2026

OCPBUGS-83863: Simplify Dockerfile to rhel9-only build openshift/multus-cni#285

Merged

Uh oh!

Conversation

sdodson commented Apr 21, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Apr 21, 2026

Summary

Test plan

Uh oh!

coderabbitai Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Estimated code review effort

Suggested reviewers

Poem

❌ Failed checks (1 warning)

Uh oh!

openshift-ci-robot commented Apr 21, 2026

Summary

Test plan

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Apr 21, 2026

Summary

Test plan

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Apr 21, 2026

Summary

Test plan

Summary by CodeRabbit

Uh oh!

sdodson commented Apr 21, 2026

Uh oh!

openshift-ci Bot commented May 23, 2026

Uh oh!

sdodson commented May 23, 2026

Uh oh!

openshift-ci Bot commented May 23, 2026

Uh oh!

sdodson commented May 23, 2026

Uh oh!

openshift-ci Bot commented May 23, 2026

Uh oh!

sdodson commented May 23, 2026

Uh oh!

openshift-ci Bot commented May 23, 2026

Uh oh!

sdodson commented May 23, 2026

Uh oh!

sdodson commented May 23, 2026

Uh oh!

sdodson commented May 23, 2026

Uh oh!

openshift-ci Bot commented May 23, 2026

Uh oh!

sdodson commented Jun 9, 2026

Uh oh!

sdodson commented Jun 9, 2026

Uh oh!

sdodson commented Jun 10, 2026

Uh oh!

sdodson commented Jun 10, 2026

Uh oh!

openshift-ci Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sdodson commented Jul 14, 2026

Uh oh!

kyrtapz Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

sdodson commented Apr 21, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Apr 21, 2026 •

edited

Loading

openshift-ci Bot commented Jun 10, 2026 •

edited

Loading