OCPBUGS-105459: KUBE_RBAC_PROXY_IMAGE is removed, and extraneous instances exist

[prb112]

OCPBUGS-105459: KUBE_RBAC_PROXY_IMAGE is removed, and extraneous instances exist

fixes: OCPBUGS-105459

- What this PR does and why is it needed

3m14s       Normal    Pulling               pod/ingress-node-firewall-daemon-9qfq9                            Pulling image "http://quay.io/openshift/origin-kube-rbac-proxy:latest "
3m8s        Normal    Pulled                pod/ingress-node-firewall-daemon-9qfq9                            Successfully pulled image "http://quay.io/openshift/origin-kube-rbac-proxy:latest " in 5.647s (5.647s including waiting). Image size: 436864195 bytes.

is implicitly used by the ClusterServiceVersion

See 100a5a2 where it removes the KUBE_RBAC_PROXY

- Special notes for reviewers

This resolves 105459.

- How to verify it

Install on ARM or Power or s390x.

- Description for the changelog

Resolve multi-arch support for non-x86

Summary by CodeRabbit

• Bug Fixes

  • Removed the unnecessary RBAC proxy image configuration requirement from controller deployment settings.
  • Simplified installation and startup by eliminating validation for the unused environment variable.

• Documentation

  • Updated local operator-running instructions to reflect the streamlined configuration.

[openshift-ci-robot]

@prb112: This pull request references Jira Issue OCPBUGS-105459, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.1.0) matches configured target version for branch (5.1.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (core-networking-bot@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

OCPBUGS-105459: KUBE_RBAC_PROXY_IMAGE is removed, and extraneous instances exist

fixes: OCPBUGS-105459

- What this PR does and why is it needed

3m14s       Normal    Pulling               pod/ingress-node-firewall-daemon-9qfq9                            Pulling image "http://quay.io/openshift/origin-kube-rbac-proxy:latest "
3m8s        Normal    Pulled                pod/ingress-node-firewall-daemon-9qfq9                            Successfully pulled image "http://quay.io/openshift/origin-kube-rbac-proxy:latest " in 5.647s (5.647s including waiting). Image size: 436864195 bytes.

is implicitly used by the ClusterServiceVersion

See 100a5a2 where it removes the KUBE_RBAC_PROXY

- Special notes for reviewers

This resolves 105459.

- How to verify it

Install on ARM or Power or s390x.

- Description for the changelog

Resolve multi-arch support for non-x86

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: fd87a4ff-e4a7-4a03-87b0-5a1a5cd07073

📥 Commits

Reviewing files that changed from the base of the PR and between 085a190 and 646833a.

📒 Files selected for processing (7)

• README.md
• bundle/manifests/ingress-node-firewall.clusterserviceversion.yaml
• config/manager/env.yaml
• controllers/ingressnodefirewallconfig_controller.go
• controllers/suite_test.go
• main.go
• manifests/stable/ingress-node-firewall.clusterserviceversion.yaml

💤 Files with no reviewable changes (7)

• manifests/stable/ingress-node-firewall.clusterserviceversion.yaml
• config/manager/env.yaml
• bundle/manifests/ingress-node-firewall.clusterserviceversion.yaml
• README.md
• controllers/suite_test.go
• controllers/ingressnodefirewallconfig_controller.go
• main.go

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

Walkthrough

The change removes KUBE_RBAC_PROXY_IMAGE from controller rendering, deployment manifests, startup validation, test setup, and local operator-running instructions.

Changes

Kube-rbac-proxy configuration removal

Layer / File(s)	Summary
Runtime configuration controllers/ingressnodefirewallconfig_controller.go, config/manager/env.yaml, bundle/manifests/..., manifests/stable/...	The controller and deployment manifests no longer define or render KUBE_RBAC_PROXY_IMAGE.
Startup and supporting setup main.go, controllers/suite_test.go, README.md	Startup no longer requires the variable. Tests and local-run instructions no longer set it.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 64683

The PR removes obsolete kube-rbac-proxy image references from the operator configuration and manifests to support non-x86 architectures; no actionable merge-blocking risk remains beyond normal checks.

Possibly related PRs

• openshift/ingress-node-firewall#771: Removes the same KUBE_RBAC_PROXY_IMAGE configuration across related controller files and manifests.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the removal of KUBE_RBAC_PROXY_IMAGE, which is the primary change in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR only removes an environment-variable setup line; no Ginkgo test title changed or was added. Existing dynamic titles are unchanged from origin/master.
Test Structure And Quality	✅ Passed	The only Ginkgo change removes one BeforeSuite environment assignment; it adds no It block, cluster operation, wait, assertion, or resource lifecycle change.
Microshift Test Compatibility	✅ Passed	The HEAD diff contains only deletions and adds no It, Describe, Context, or When test. The MicroShift test-compatibility check is therefore not triggered.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The diff adds no Ginkgo e2e tests or test cases. It only removes KUBE_RBAC_PROXY_IMAGE configuration and related setup, so no SNO multi-node assumption is introduced.
Topology-Aware Scheduling Compatibility	✅ Passed	The parent-to-HEAD diff only deletes KUBE_RBAC_PROXY_IMAGE references; it adds no affinity, spread, selector, toleration, PDB, or replica scheduling constraint.
Ote Binary Stdout Contract	✅ Passed	The exact HEAD^..HEAD diff has 0 additions and only removes environment-variable handling; no changed process-level code writes to stdout.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The pull request only deletes environment-variable and manifest/controller lines; the diff adds no Ginkgo e2e tests or network assumptions.
No-Weak-Crypto	✅ Passed	The HEAD^..HEAD diff has zero added lines and only removes KUBE_RBAC_PROXY_IMAGE entries; it introduces no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparison code.
Container-Privileges	✅ Passed	The PR only removes KUBE_RBAC_PROXY_IMAGE references. The diff adds no privilege fields; existing hostNetwork, hostPID, and runAsNonRoot:false declarations are unchanged from the parent.
No-Sensitive-Data-In-Logs	✅ Passed	The pull request changes only deletions. It adds no logging calls or sensitive values; the removed log reported a missing environment variable.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[prb112]

/cc @asood-rh

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: prb112
Once this PR has been reviewed and has the lgtm label, please assign knobunc for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[asood-rh]

There is PR #771 already created for the bug.

[openshift-ci-robot]

@prb112: This pull request references Jira Issue OCPBUGS-105459. The bug has been updated to no longer refer to the pull request using the external bug tracker.

Details

In response to this:

OCPBUGS-105459: KUBE_RBAC_PROXY_IMAGE is removed, and extraneous instances exist

fixes: OCPBUGS-105459

- What this PR does and why is it needed

3m14s       Normal    Pulling               pod/ingress-node-firewall-daemon-9qfq9                            Pulling image "http://quay.io/openshift/origin-kube-rbac-proxy:latest "
3m8s        Normal    Pulled                pod/ingress-node-firewall-daemon-9qfq9                            Successfully pulled image "http://quay.io/openshift/origin-kube-rbac-proxy:latest " in 5.647s (5.647s including waiting). Image size: 436864195 bytes.

is implicitly used by the ClusterServiceVersion

See 100a5a2 where it removes the KUBE_RBAC_PROXY

- Special notes for reviewers

This resolves 105459.

- How to verify it

Install on ARM or Power or s390x.

- Description for the changelog

Resolve multi-arch support for non-x86

Summary by CodeRabbit

• Bug Fixes

• Removed the unnecessary RBAC proxy image configuration requirement from controller deployment settings.

• Simplified installation and startup by eliminating validation for the unused environment variable.

• Documentation

• Updated local operator-running instructions to reflect the streamlined configuration.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@prb112: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/unit-test	646833a	link	true	/test unit-test

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.