Skip to content

STOR-2997: Minimal implementation of GCP PD CSI driver operator#576

Open
mpatlasov wants to merge 2 commits into
openshift:mainfrom
mpatlasov:STOR-2997-Implement-GCP-PD-CSI-driver-operator-inside-csi-operator-framework
Open

STOR-2997: Minimal implementation of GCP PD CSI driver operator#576
mpatlasov wants to merge 2 commits into
openshift:mainfrom
mpatlasov:STOR-2997-Implement-GCP-PD-CSI-driver-operator-inside-csi-operator-framework

Conversation

@mpatlasov

Copy link
Copy Markdown
Contributor

This PR implements the minimal set of go-files and yaml-assets to enable the command

./bin/gcp-pd-csi-driver-smb-operator start --kubeconfig $KUBECONFIG --namespace openshift-cluster-csi-drivers

to install and run GCP PD CSI driver:

gcp-pd-csi-driver-controller-c949b748-xkljz   10/10   Running   0          3m2s
gcp-pd-csi-driver-controller-c949b748-xvgl9   10/10   Running   0          3m2s
gcp-pd-csi-driver-node-5kcw5                  3/3     Running   0          3m2s
gcp-pd-csi-driver-node-frl74                  3/3     Running   0          3m2s
gcp-pd-csi-driver-node-gf9k7                  3/3     Running   0          3m2s
gcp-pd-csi-driver-node-p95sv                  3/3     Running   0          3m2s
gcp-pd-csi-driver-node-q4r98                  3/3     Running   0          3m2s
gcp-pd-csi-driver-node-xvmgq                  3/3     Running   0          3m2s

/cc @openshift/storage

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 8, 2026
@openshift-ci-robot

openshift-ci-robot commented Jul 8, 2026

Copy link
Copy Markdown

@mpatlasov: This pull request references STOR-2997 which is a valid jira issue.

Details

In response to this:

This PR implements the minimal set of go-files and yaml-assets to enable the command

./bin/gcp-pd-csi-driver-smb-operator start --kubeconfig $KUBECONFIG --namespace openshift-cluster-csi-drivers

to install and run GCP PD CSI driver:

gcp-pd-csi-driver-controller-c949b748-xkljz   10/10   Running   0          3m2s
gcp-pd-csi-driver-controller-c949b748-xvgl9   10/10   Running   0          3m2s
gcp-pd-csi-driver-node-5kcw5                  3/3     Running   0          3m2s
gcp-pd-csi-driver-node-frl74                  3/3     Running   0          3m2s
gcp-pd-csi-driver-node-gf9k7                  3/3     Running   0          3m2s
gcp-pd-csi-driver-node-p95sv                  3/3     Running   0          3m2s
gcp-pd-csi-driver-node-q4r98                  3/3     Running   0          3m2s
gcp-pd-csi-driver-node-xvmgq                  3/3     Running   0          3m2s

/cc @openshift/storage

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci

openshift-ci Bot commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

@mpatlasov: GitHub didn't allow me to request PR reviews from the following users: openshift/storage.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

This PR implements the minimal set of go-files and yaml-assets to enable the command

./bin/gcp-pd-csi-driver-smb-operator start --kubeconfig $KUBECONFIG --namespace openshift-cluster-csi-drivers

to install and run GCP PD CSI driver:

gcp-pd-csi-driver-controller-c949b748-xkljz   10/10   Running   0          3m2s
gcp-pd-csi-driver-controller-c949b748-xvgl9   10/10   Running   0          3m2s
gcp-pd-csi-driver-node-5kcw5                  3/3     Running   0          3m2s
gcp-pd-csi-driver-node-frl74                  3/3     Running   0          3m2s
gcp-pd-csi-driver-node-gf9k7                  3/3     Running   0          3m2s
gcp-pd-csi-driver-node-p95sv                  3/3     Running   0          3m2s
gcp-pd-csi-driver-node-q4r98                  3/3     Running   0          3m2s
gcp-pd-csi-driver-node-xvmgq                  3/3     Running   0          3m2s

/cc @openshift/storage

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@coderabbitai

coderabbitai Bot commented Jul 8, 2026

Copy link
Copy Markdown
📝 Walkthrough

Walkthrough

Adds a GCP PD CSI Driver Operator CLI entrypoint with Cobra-based root and start commands. Defines operator and controller configuration, including standalone cluster validation and client configuration informer startup. Updates the Dockerfile to build the operator from the repository workspace and copy the resulting binary into the final image.


Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (2 errors)

Check name Status Explanation Resolution
Ote Binary Stdout Contract ❌ Error New main() calls cmd.Help(), and Cobra explicitly writes help to stdout, violating the OTE stdout-only JSON contract. Avoid printing help in process-level code or redirect command output to stderr before calling Help().
Container-Privileges ❌ Error GCP-PD manifests set hostNetwork:true and privileged:true in the node DaemonSet, which violates the check. Remove the privileged/hostNetwork settings from the GCP-PD manifests, or add an explicit justified exception if they’re required.
✅ Passed checks (13 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly summarizes the main change: a minimal implementation of the GCP PD CSI driver operator.
Description check ✅ Passed The description is directly related to the changeset and explains the new command and driver startup behavior.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed No _test.go files or Ginkgo title APIs appear in the PR diff; the changed files are implementation/assets only.
Test Structure And Quality ✅ Passed No Ginkgo tests were added or modified in this PR; the only touched test file was a deleted non-Ginkgo Go test, so the check is not applicable.
Microshift Test Compatibility ✅ Passed No new Ginkgo e2e tests were added; touched files are operator code and Dockerfile, with no MicroShift-unsafe APIs or assumptions.
Single Node Openshift (Sno) Test Compatibility ✅ Passed No new Ginkgo e2e tests were added; the changed files are an operator entrypoint, runtime config, and Dockerfile, with no test DSL or SNO-sensitive assumptions.
Topology-Aware Scheduling Compatibility ✅ Passed No affinity, nodeSelector, spread, replica, or taint-based scheduling logic was added; the new command/config files only wire operator startup.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed No new Ginkgo e2e tests were added in the touched files, and the new code has no It/Describe/Context/When or external connectivity.
No-Weak-Crypto ✅ Passed The changed files add no weak-crypto primitives, custom crypto, or secret comparisons; searches found no MD5/SHA1/DES/RC4/ECB usage in the PR scope.
No-Sensitive-Data-In-Logs ✅ Passed Scanned the new operator and gcp-pd files; the only new log call is a generic unsupported-flavour error, with no passwords/tokens/PII/hostnames in logs.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-ci

openshift-ci Bot commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mpatlasov

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 8, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (2)
pkg/driver/gcp-pd/gcp_pd.go (1)

36-39: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Fix malformed log call and redundant/non-idiomatic error message.

klog.Error(nil, "...") treats nil as a fmt.Print-style argument (klog's Error args are "handled in the manner of fmt.Print"), so this prints something like <nil>Flavour HyperShift is not supported! instead of a clean message. Additionally, this error is already logged again by the caller (RunOperator logs "error building operator config: %v" on any non-nil error from this builder), so the local klog.Error call is redundant. The fmt.Errorf message is also capitalized and ends with !, which violates Go's error-string convention (lower-case, no trailing punctuation).

🔧 Proposed fix
 	if flavour != generator.FlavourStandalone {
-		klog.Error(nil, "Flavour HyperShift is not supported!")
-		return nil, fmt.Errorf("Flavour HyperShift is not supported!")
+		return nil, fmt.Errorf("flavour %q is not supported", flavour)
 	}
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/driver/gcp-pd/gcp_pd.go` around lines 36 - 39, The gcp_pd builder’s
unsupported-flavour branch is logging incorrectly and returning a non-idiomatic
error. In the config builder path in `gcp_pd.go`, remove the local
`klog.Error(nil, ...)` call because `RunOperator` already logs builder failures,
and change the returned `fmt.Errorf` message to a lowercase, punctuation-free
error string. Keep the check on `flavour != generator.FlavourStandalone` and
ensure the branch only returns the clean error.
cmd/gcp-pd-csi-driver-operator/main.go (1)

27-30: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Ignored error return from cmd.Help().

cmd.Help() returns an error that's discarded here.

🔧 Proposed fix
 		Run: func(cmd *cobra.Command, args []string) {
-			cmd.Help()
+			if err := cmd.Help(); err != nil {
+				klog.Errorf("failed to print help: %v", err)
+			}
 			os.Exit(1)
 		},

As per path instructions, "Never ignore error returns" for **/*.go.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cmd/gcp-pd-csi-driver-operator/main.go` around lines 27 - 30, The cobra
command’s Run handler is discarding the error from cmd.Help(), which violates
the “never ignore error returns” rule. Update the Run function in main.go to
check and handle the return value from cmd.Help() explicitly, using the
cmd.Help() call itself as the unique locator, and ensure the process still exits
with a non-zero status if Help fails.

Source: Path instructions

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@cmd/gcp-pd-csi-driver-operator/main.go`:
- Around line 27-30: The cobra command’s Run handler is discarding the error
from cmd.Help(), which violates the “never ignore error returns” rule. Update
the Run function in main.go to check and handle the return value from cmd.Help()
explicitly, using the cmd.Help() call itself as the unique locator, and ensure
the process still exits with a non-zero status if Help fails.

In `@pkg/driver/gcp-pd/gcp_pd.go`:
- Around line 36-39: The gcp_pd builder’s unsupported-flavour branch is logging
incorrectly and returning a non-idiomatic error. In the config builder path in
`gcp_pd.go`, remove the local `klog.Error(nil, ...)` call because `RunOperator`
already logs builder failures, and change the returned `fmt.Errorf` message to a
lowercase, punctuation-free error string. Keep the check on `flavour !=
generator.FlavourStandalone` and ensure the branch only returns the clean error.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 51202570-b405-4a12-9cee-b72111c8a207

📥 Commits

Reviewing files that changed from the base of the PR and between 1c2b08b and 5ed0670.

⛔ Files ignored due to path filters (30)
  • assets/overlays/gcp-pd/generated/standalone/cabundle_cm.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/controller.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/controller_pdb.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/controller_sa.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/csidriver.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/kube_rbac_proxy_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/kube_rbac_proxy_role.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/lease_leader_election_role.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/lease_leader_election_rolebinding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/main_attacher_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/main_provisioner_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/main_resizer_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/main_snapshotter_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/manifests.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/node.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/node_privileged_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/node_sa.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/privileged_role.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/prometheus_role.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/prometheus_rolebinding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/service.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/servicemonitor.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/storageclass.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/storageclass_reader_resizer_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/storageclass_ssd.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/volumeattributesclass_reader_provisioner_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/volumeattributesclass_reader_resizer_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/volumesnapshot_reader_provisioner_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/volumesnapshotclass.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/volumesnapshotclass_images.yaml is excluded by !**/generated/**
📒 Files selected for processing (2)
  • cmd/gcp-pd-csi-driver-operator/main.go
  • pkg/driver/gcp-pd/gcp_pd.go

@mpatlasov

Copy link
Copy Markdown
Contributor Author

/retest

@mpatlasov

Copy link
Copy Markdown
Contributor Author

/retest-required

2 similar comments
@mpatlasov

Copy link
Copy Markdown
Contributor Author

/retest-required

@mpatlasov

Copy link
Copy Markdown
Contributor Author

/retest-required

@rhrmo

rhrmo commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

/test hypershift-e2e-aks

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (2)
Dockerfile.gcp-pd (2)

3-3: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Avoid copying entire build context.

COPY . . copies the full repository into the builder stage instead of specific files/directories needed for the build. As per path instructions, "COPY specific files, not entire context."

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile.gcp-pd` at line 3, Replace the broad COPY instruction in the
Docker build stage with explicit COPY directives for only the files and
directories required by the build, excluding the rest of the repository context.

Source: Path instructions


6-10: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Missing HEALTHCHECK instruction.

No HEALTHCHECK is defined for the final image. As per path instructions, "HEALTHCHECK defined."

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile.gcp-pd` around lines 6 - 10, Add a HEALTHCHECK instruction to the
final image definition in Dockerfile.gcp-pd, alongside the existing ENTRYPOINT
and LABEL directives. Configure it to invoke an appropriate health probe for
gcp-pd-csi-driver-operator and preserve the current startup command.

Source: Path instructions

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Dockerfile.gcp-pd`:
- Around line 6-10: Update the final image stage in the Dockerfile around the
gcp-pd-csi-driver-operator ENTRYPOINT to add a non-root USER directive, ensuring
the operator runs as non-root while preserving the existing image metadata and
startup command.

---

Nitpick comments:
In `@Dockerfile.gcp-pd`:
- Line 3: Replace the broad COPY instruction in the Docker build stage with
explicit COPY directives for only the files and directories required by the
build, excluding the rest of the repository context.
- Around line 6-10: Add a HEALTHCHECK instruction to the final image definition
in Dockerfile.gcp-pd, alongside the existing ENTRYPOINT and LABEL directives.
Configure it to invoke an appropriate health probe for
gcp-pd-csi-driver-operator and preserve the current startup command.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 19e8acdf-4877-4e40-93b2-802e0864bd31

📥 Commits

Reviewing files that changed from the base of the PR and between 5ed0670 and fa76b6a.

📒 Files selected for processing (1)
  • Dockerfile.gcp-pd

Comment thread Dockerfile.gcp-pd
Comment on lines 6 to 10
FROM registry.ci.openshift.org/ocp/5.0:base-rhel9
COPY --from=builder /go/src/github.com/openshift/gcp-pd-csi-driver-operator/gcp-pd-csi-driver-operator /usr/bin/
COPY --from=builder /go/src/github.com/openshift/csi-operator/bin/gcp-pd-csi-driver-operator /usr/bin/
ENTRYPOINT ["/usr/bin/gcp-pd-csi-driver-operator"]
LABEL io.k8s.display-name="OpenShift GCP PD CSI Driver Operator" \
io.k8s.description="The GCP PD CSI Driver Operator installs and maintains the GCP PD CSI Driver on a cluster."

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Missing non-root USER directive in final image.

The final stage runs the operator without setting a non-root USER, so the container defaults to root. As per path instructions, "USER non-root; never run as root."

🔒 Proposed fix
 FROM registry.ci.openshift.org/ocp/5.0:base-rhel9
 COPY --from=builder /go/src/github.com/openshift/csi-operator/bin/gcp-pd-csi-driver-operator /usr/bin/
+USER 65532:65532
 ENTRYPOINT ["/usr/bin/gcp-pd-csi-driver-operator"]
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
FROM registry.ci.openshift.org/ocp/5.0:base-rhel9
COPY --from=builder /go/src/github.com/openshift/gcp-pd-csi-driver-operator/gcp-pd-csi-driver-operator /usr/bin/
COPY --from=builder /go/src/github.com/openshift/csi-operator/bin/gcp-pd-csi-driver-operator /usr/bin/
ENTRYPOINT ["/usr/bin/gcp-pd-csi-driver-operator"]
LABEL io.k8s.display-name="OpenShift GCP PD CSI Driver Operator" \
io.k8s.description="The GCP PD CSI Driver Operator installs and maintains the GCP PD CSI Driver on a cluster."
FROM registry.ci.openshift.org/ocp/5.0:base-rhel9
COPY --from=builder /go/src/github.com/openshift/csi-operator/bin/gcp-pd-csi-driver-operator /usr/bin/
USER 65532:65532
ENTRYPOINT ["/usr/bin/gcp-pd-csi-driver-operator"]
LABEL io.k8s.display-name="OpenShift GCP PD CSI Driver Operator" \
io.k8s.description="The GCP PD CSI Driver Operator installs and maintains the GCP PD CSI Driver on a cluster."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile.gcp-pd` around lines 6 - 10, Update the final image stage in the
Dockerfile around the gcp-pd-csi-driver-operator ENTRYPOINT to add a non-root
USER directive, ensuring the operator runs as non-root while preserving the
existing image metadata and startup command.

Source: Path instructions

@mpatlasov mpatlasov force-pushed the STOR-2997-Implement-GCP-PD-CSI-driver-operator-inside-csi-operator-framework branch from fa76b6a to d85ac06 Compare July 14, 2026 00:29

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cmd/gcp-pd-csi-driver-operator/main.go`:
- Line 28: Update the Cobra command handler around cmd.Help() to handle its
returned error instead of discarding it. Use the error-returning command flow,
such as RunE, and return cmd.Help() so help-output failures propagate; ensure no
Go error return remains ignored.

In `@Dockerfile.gcp-pd`:
- Line 3: Replace the broad COPY . . instruction in the Dockerfile build stage
with explicit COPY directives for only the manifests and source directories
required by this build target. Exclude secrets, credentials, build artifacts,
and unrelated repository files from the builder context.

In `@pkg/driver/gcp-pd/gcp_pd.go`:
- Line 38: Update the error string returned by the HyperShift handling in the
relevant function to remove the trailing exclamation mark, preserving the exact
message text as “Flavour HyperShift is not supported”.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: b1bd05f7-b7fc-430b-877a-41c866600a9b

📥 Commits

Reviewing files that changed from the base of the PR and between fa76b6a and d85ac06.

⛔ Files ignored due to path filters (32)
  • assets/overlays/gcp-pd/generated/standalone/cabundle_cm.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/controller.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/controller_hostnetwork_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/controller_pdb.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/controller_sa.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/csidriver.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/hostnetwork_role.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/kube_rbac_proxy_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/kube_rbac_proxy_role.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/lease_leader_election_role.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/lease_leader_election_rolebinding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/main_attacher_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/main_provisioner_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/main_resizer_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/main_snapshotter_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/manifests.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/node.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/node_privileged_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/node_sa.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/privileged_role.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/prometheus_role.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/prometheus_rolebinding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/service.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/servicemonitor.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/storageclass.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/storageclass_reader_resizer_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/storageclass_ssd.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/volumeattributesclass_reader_provisioner_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/volumeattributesclass_reader_resizer_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/volumesnapshot_reader_provisioner_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/volumesnapshotclass.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/volumesnapshotclass_images.yaml is excluded by !**/generated/**
📒 Files selected for processing (3)
  • Dockerfile.gcp-pd
  • cmd/gcp-pd-csi-driver-operator/main.go
  • pkg/driver/gcp-pd/gcp_pd.go

Use: "gcp-pd-csi-driver-operator",
Short: "OpenShift GCP PD CSI Driver Operator",
Run: func(cmd *cobra.Command, args []string) {
cmd.Help()

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Handle the cmd.Help() error.

Line 28 discards Cobra’s returned error, so help-output failures are silently lost. Check and propagate/handle it, for example by using RunE and returning cmd.Help().

As per path instructions: Go code must never ignore error returns.

🧰 Tools
🪛 golangci-lint (2.12.2)

[error] 28-28: Error return value of cmd.Help is not checked

(errcheck)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cmd/gcp-pd-csi-driver-operator/main.go` at line 28, Update the Cobra command
handler around cmd.Help() to handle its returned error instead of discarding it.
Use the error-returning command flow, such as RunE, and return cmd.Help() so
help-output failures propagate; ensure no Go error return remains ignored.

Sources: Path instructions, Linters/SAST tools

Comment thread Dockerfile.gcp-pd
COPY legacy/gcp-pd-csi-driver-operator .
RUN make
WORKDIR /go/src/github.com/openshift/csi-operator
COPY . .

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

Do not copy the entire build context.

COPY . . places every repository file into the builder stage, potentially including secrets, credentials, and unrelated artifacts. Copy only the manifests and source directories required by this build target.

As per path instructions, “COPY specific files, not entire context.”

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile.gcp-pd` at line 3, Replace the broad COPY . . instruction in the
Dockerfile build stage with explicit COPY directives for only the manifests and
source directories required by this build target. Exclude secrets, credentials,
build artifacts, and unrelated repository files from the builder context.

Source: Path instructions

Comment thread pkg/driver/gcp-pd/gcp_pd.go Outdated
This PR implements the minimal set of go-files and yaml-assets to enable the command
```
./bin/gcp-pd-csi-driver-smb-operator start --kubeconfig $KUBECONFIG --namespace openshift-cluster-csi-drivers
```
to install and run GCP PD CSI driver:
```
gcp-pd-csi-driver-controller-c949b748-xkljz   10/10   Running   0          3m2s
gcp-pd-csi-driver-controller-c949b748-xvgl9   10/10   Running   0          3m2s
gcp-pd-csi-driver-node-5kcw5                  3/3     Running   0          3m2s
gcp-pd-csi-driver-node-frl74                  3/3     Running   0          3m2s
gcp-pd-csi-driver-node-gf9k7                  3/3     Running   0          3m2s
gcp-pd-csi-driver-node-p95sv                  3/3     Running   0          3m2s
gcp-pd-csi-driver-node-q4r98                  3/3     Running   0          3m2s
gcp-pd-csi-driver-node-xvmgq                  3/3     Running   0          3m2s
```
Use gcp-pd go files from cmd/ and pkg/ dirs rather than legacy/
@mpatlasov mpatlasov force-pushed the STOR-2997-Implement-GCP-PD-CSI-driver-operator-inside-csi-operator-framework branch from d85ac06 to 3c7108f Compare July 14, 2026 00:54

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/driver/gcp-pd/gcp_pd.go`:
- Line 38: Update the unsupported-flavour error in the relevant driver function
to start with a lowercase letter, while retaining the flavour-specific context
by formatting the flavour value in the message.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 926fa496-de4b-4f51-98ab-16491ea1ea52

📥 Commits

Reviewing files that changed from the base of the PR and between d85ac06 and 3c7108f.

⛔ Files ignored due to path filters (32)
  • assets/overlays/gcp-pd/generated/standalone/cabundle_cm.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/controller.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/controller_hostnetwork_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/controller_pdb.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/controller_sa.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/csidriver.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/hostnetwork_role.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/kube_rbac_proxy_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/kube_rbac_proxy_role.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/lease_leader_election_role.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/lease_leader_election_rolebinding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/main_attacher_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/main_provisioner_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/main_resizer_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/main_snapshotter_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/manifests.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/node.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/node_privileged_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/node_sa.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/privileged_role.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/prometheus_role.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/prometheus_rolebinding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/service.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/servicemonitor.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/storageclass.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/storageclass_reader_resizer_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/storageclass_ssd.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/volumeattributesclass_reader_provisioner_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/volumeattributesclass_reader_resizer_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/volumesnapshot_reader_provisioner_binding.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/volumesnapshotclass.yaml is excluded by !**/generated/**
  • assets/overlays/gcp-pd/generated/standalone/volumesnapshotclass_images.yaml is excluded by !**/generated/**
📒 Files selected for processing (3)
  • Dockerfile.gcp-pd
  • cmd/gcp-pd-csi-driver-operator/main.go
  • pkg/driver/gcp-pd/gcp_pd.go
🚧 Files skipped from review as they are similar to previous changes (2)
  • cmd/gcp-pd-csi-driver-operator/main.go
  • Dockerfile.gcp-pd

func GetGCPPDOperatorControllerConfig(ctx context.Context, flavour generator.ClusterFlavour, c *clients.Clients) (*config.OperatorControllerConfig, error) {
if flavour != generator.FlavourStandalone {
klog.Error(nil, "Flavour HyperShift is not supported")
return nil, fmt.Errorf("Flavour HyperShift is not supported")

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Lowercase the returned error string.

ST1005 still flags this line because Go error strings must not start with an uppercase letter. Use a lowercase, flavour-specific message such as fmt.Errorf("flavour %v is not supported", flavour).

Static analysis reports ST1005: error strings should not be capitalized.

🧰 Tools
🪛 golangci-lint (2.12.2)

[error] 38-38: ST1005: error strings should not be capitalized

(staticcheck)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/driver/gcp-pd/gcp_pd.go` at line 38, Update the unsupported-flavour error
in the relevant driver function to start with a lowercase letter, while
retaining the flavour-specific context by formatting the flavour value in the
message.

Source: Linters/SAST tools

@openshift-ci

openshift-ci Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

@mpatlasov: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-azure 3c7108f link true /test e2e-azure
ci/prow/hypershift-aws-e2e-external 3c7108f link true /test hypershift-aws-e2e-external

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants