fix(EC-1977): migrate tenant-release SA to konflux-bot-0#3385
Open
robnester-rh wants to merge 1 commit into
Open
fix(EC-1977): migrate tenant-release SA to konflux-bot-0#3385robnester-rh wants to merge 1 commit into
robnester-rh wants to merge 1 commit into
Conversation
PR Summary by QodoMigrate release RBAC to use pre-created konflux-bot-0 ServiceAccount
AI Description
Diagram
High-Level Assessment
Files changed (1)
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe release setup manifest now documents and binds the pre-created ChangesRelease pipeline account update
Estimated code review effort: 1 (Trivial) | ~3 minutes Related PRs: None identified. Suggested labels: release, configuration Suggested reviewers: None identified. PoemA bunny hopped through YAML fields so neat, 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Code Review by Qodo
Context used✅ Compliance rules (platform):
27 rules 1. Outdated setup README
|
![qodo-for-conforma[bot]](https://avatars.githubusercontent.com/in/3609154?s=60&v=4){kind=small}
Comment on lines
+18
to
27
| # The konflux-bot-0 ServiceAccount is pre-created by Konflux. The secrets | ||
| # and role binding below grant it push access to the release registries | ||
| # and read access to release resources. | ||
| # | ||
| # The following secrets must be attached to konflux-bot-0 in the cluster: | ||
| # - ec-cli-main: push credential for quay.io/conforma/cli | ||
| # and quay.io/enterprise-contract/cli | ||
| # - ec-tekton-task-main: push credential for quay.io/conforma/tekton-task | ||
| # and quay.io/enterprise-contract/tekton-task | ||
| --- |
There was a problem hiding this comment.
1. Leading empty yaml 🐞 Bug ☼ Reliability
release/setup.yaml now contains an initial YAML document consisting only of comments (started by a leading --- and ended by the next ---), which can deserialize to an empty object and fail in apply flows that expect apiVersion/kind per document.
Agent Prompt
### Issue description
`release/setup.yaml` currently has two YAML document separators (`---`) with only comments in between, which creates an empty first YAML document. Some YAML consumers (including this repo’s apply helper) unmarshal each document and immediately use its GVK; empty docs will produce an object with no GVK and can error.
### Issue Context
This was introduced when the `ServiceAccount` manifest was removed but the original document structure (`---` separators) remained.
### Fix Focus Areas
- release/setup.yaml[1-28]
### Suggested fix
Remove the leading `---` at the very top of `release/setup.yaml` (or alternatively remove the separator at current line ~27) so the first YAML document contains a real Kubernetes object (Role) rather than only comments.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+18
to
+26
| # The konflux-bot-0 ServiceAccount is pre-created by Konflux. The secrets | ||
| # and role binding below grant it push access to the release registries | ||
| # and read access to release resources. | ||
| # | ||
| # The following secrets must be attached to konflux-bot-0 in the cluster: | ||
| # - ec-cli-main: push credential for quay.io/conforma/cli | ||
| # and quay.io/enterprise-contract/cli | ||
| # - ec-tekton-task-main: push credential for quay.io/conforma/tekton-task | ||
| # and quay.io/enterprise-contract/tekton-task |
There was a problem hiding this comment.
2. Outdated setup readme 🐞 Bug ⚙ Maintainability
release/README.md still claims setup.yaml "creates a ServiceAccount", but the PR removes the ServiceAccount manifest and instead assumes an externally pre-created konflux-bot-0 SA, which will mislead operators following the setup docs.
Agent Prompt
### Issue description
The release setup documentation no longer matches what `release/setup.yaml` actually creates after migrating to `konflux-bot-0`.
### Issue Context
`release/setup.yaml` now only defines RBAC and comments about required secrets, and does not create a ServiceAccount.
### Fix Focus Areas
- release/README.md[6-10]
- release/setup.yaml[18-26]
### Suggested fix
Update `release/README.md` to state that `setup.yaml` creates the Role/RoleBinding for the pre-created `konflux-bot-0` ServiceAccount and that the listed secrets must already be attached to `konflux-bot-0` in the cluster.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Codecov Report✅ All modified and coverable lines are covered by tests.
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
Replace the tenant-release ServiceAccount with the predefined konflux-bot-0 SA to comply with Konflux SA security policy. - Remove SA definition (konflux-bot-0 is pre-created by Konflux) - Update RoleBinding subject to reference konflux-bot-0 - Document required secrets in comments resolves: EC-1977 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrate the
tenant-releaseServiceAccount to the predefinedkonflux-bot-0SA to comply with Konflux SA security policy. Deadline: July 30, 2026.tenant-releasetoconforma-releasekonflux-bot-0ec-cli-main,ec-tekton-task-main) in commentsDependencies
serviceAccountName) should merge firstkonflux-bot-0must be configured in the clusterTest plan
konflux-bot-0has correct secrets attached in clustertenant-releaseSA can be safely deleted🤖 Generated with Claude Code