CodeRabbit Review Feedback

CLAUDE.md

@@ -212,7 +212,8 @@ The operator binary runs in four mutually exclusive modes (controlled by flags i
 **Mutating Webhook** (`internal/controller/podplacement/scheduling_gate_mutating_webhook.go`):
 - Adds `multiarch.openshift.io/scheduling-gate` to new pods
 - Respects namespace selector from ClusterPodPlacementConfig
-- Always excludes: `openshift-*`, `kube-*`, `hypershift-*` namespaces
+- Always excludes: `kube-*` namespaces (hardcoded)
+- Other namespaces (`openshift-*`, `hypershift-*`, etc.) can be included via namespaceSelector configuration
 - Uses worker pool for event publishing (ants library, 16 workers)
 
 **Image Inspector** (`pkg/image/inspector.go`):
@@ -244,12 +245,15 @@ The operator binary runs in four mutually exclusive modes (controlled by flags i
 
 ### Namespace Exclusions
 
-System namespaces are excluded from pod placement by default (cannot be overridden):
-- `openshift-*`
-- `kube-*`
-- `hypershift-*`
+**Hardcoded exclusions** (cannot be overridden):
+- `kube-*` - Core Kubernetes namespaces are always excluded
 
-Additional namespaces can be excluded via namespaceSelector with label `multiarch.openshift.io/exclude-pod-placement`.
+**Configurable via namespaceSelector:**
+- All other namespaces (including `openshift-*`, `hypershift-*`, user namespaces) can be included or excluded by configuring the `namespaceSelector` field in ClusterPodPlacementConfig
+- Common exclusion pattern: add label `multiarch.openshift.io/exclude-pod-placement` to namespaces you want to skip
+- Default example namespaceSelector excludes namespaces with this label
+
+The operator namespace is also always excluded from pod placement.
 
 ### Plugins System
 
@@ -340,7 +344,7 @@ RUNTIME_IMAGE=<custom-image>   # Override runtime base image
 ## Important Constraints
 
 - ClusterPodPlacementConfig must be named "cluster" (singleton enforced by webhook)
-- Namespaces `openshift-*`, `kube-*`, and `hypershift-*` are always excluded from pod placement
+- Only `kube-*` namespaces are hardcoded as always excluded from pod placement; other system namespaces (`openshift-*`, `hypershift-*`) can be included via namespaceSelector configuration
 - CGO is required for building (uses gpgme for registry authentication)
 - Only one execution mode flag can be set at a time in main.go
 - The operator uses vendored dependencies (`GOFLAGS=-mod=vendor`)

api/v1beta1/clusterpodplacementconfig_types.go

@@ -64,6 +64,7 @@ type ClusterPodPlacementConfigStatus struct {
 	Conditions []metav1.Condition `json:"conditions,omitempty"`
 
 	// The following fields are used to derive the conditions. They are not exposed to the user.
+	// nolint:staticcheck,revive // controller-gen requires json tags on all fields, even unexported ones
 	available                                bool `json:"-"`
 	progressing                              bool `json:"-"`
 	degraded                                 bool `json:"-"`

api/v1beta1/clusterpodplacementconfig_webhook.go

@@ -21,6 +21,8 @@ import (
 	"errors"
 	"fmt"
 
+	"github.com/openshift/multiarch-tuning-operator/api/common"
+
 	"k8s.io/apimachinery/pkg/runtime"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -72,6 +74,9 @@ func (v *ClusterPodPlacementConfigValidator) validate(obj runtime.Object) (warni
 	if !ok {
 		return nil, errors.New("not a ClusterPodPlacementConfig")
 	}
+	if cppc.Name != common.SingletonResourceObjectName {
+		return nil, fmt.Errorf("ClusterPodPlacementConfig must be named %q", common.SingletonResourceObjectName)
+	}
 	if cppc.Spec.Plugins == nil || cppc.Spec.Plugins.NodeAffinityScoring == nil {
 		return nil, nil
 	}

api/v1beta1/podplacementconfig_types.go

@@ -33,9 +33,8 @@ type PodPlacementConfigSpec struct {
 	LabelSelector *metav1.LabelSelector `json:"labelSelector,omitempty"`
 
 	// Plugins defines the configurable plugins for this component.
-	// This field is required.
-	// +kubebuilder:validation:Required
-	Plugins *plugins.LocalPlugins `json:"plugins"`
+	// +optional
+	Plugins *plugins.LocalPlugins `json:"plugins,omitempty"`
 
 	// Priority defines the priority of the PodPlacementConfig and only accepts values in the range 0-255.
 	// This field is optional and will default to 0 if not set.

bundle/manifests/multiarch-tuning-operator.clusterserviceversion.yaml

@@ -27,7 +27,7 @@ metadata:
     categories: OpenShift Optional, Other
     console.openshift.io/disable-operand-delete: "false"
     containerImage: registry.ci.openshift.org/origin/multiarch-tuning-operator:main
-    createdAt: "2026-03-02T21:50:07Z"
+    createdAt: "2026-04-14T00:14:34Z"
     features.operators.openshift.io/cnf: "false"
     features.operators.openshift.io/cni: "false"
     features.operators.openshift.io/csi: "false"

bundle/manifests/multiarch.openshift.io_podplacementconfigs.yaml

@@ -90,9 +90,7 @@ spec:
                 type: object
                 x-kubernetes-map-type: atomic
               plugins:
-                description: |-
-                  Plugins defines the configurable plugins for this component.
-                  This field is required.
+                description: Plugins defines the configurable plugins for this component.
                 properties:
                   nodeAffinityScoring:
                     description: NodeAffinityScoring is the plugin that implements
@@ -144,8 +142,6 @@ spec:
                 maximum: 255
                 minimum: 0
                 type: integer
-            required:
-            - plugins
             type: object
           status:
             description: PodPlacementConfigStatus defines the observed state of PodPlacementConfig

cmd/enoexec-daemon/main.go

@@ -30,16 +30,19 @@ func main() {
 }
 
 func bindFlags() {
-	flag.IntVar(&initialLogLevel, "initial-log-level", 0, "Initial log level. From 0 (Normal) to 5 (TraceAll)")
+	flag.IntVar(&initialLogLevel, "initial-log-level", 0, "Initial log level. From 0 (Normal) to 10 (maximum verbosity)")
 	flag.BoolVar(&logDevMode, "log-dev-mode", false, "Enable development mode for zap logger")
 	flag.Parse()
 }
 
 func initContext() (context.Context, context.CancelFunc) {
 	ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	if initialLogLevel < 0 || initialLogLevel > 10 {
+		must(fmt.Errorf("initial-log-level must be in range [0,10], got %d", initialLogLevel), "invalid flag value")
+	}
 	var logImpl *zap.Logger
 	var err error
-	logLevel := zapcore.Level(int8(-initialLogLevel)) // #nosec G115 -- initialLogLevel is constrained to 0-5 range
+	logLevel := zapcore.Level(-initialLogLevel)
 	if logDevMode {
 		cfg := zap.NewDevelopmentConfig()
 		cfg.Level = zap.NewAtomicLevelAt(logLevel)

cmd/main.go

@@ -297,6 +297,9 @@ func validateFlags() error {
 	if btoi(enableOperator)+btoi(enableClusterPodPlacementConfigOperandControllers)+btoi(enableClusterPodPlacementConfigOperandWebHook)+btoi(enableENoExecEventControllers) > 1 {
 		return errors.New("only one of the following flags can be set: --enable-operator, --enable-ppc-controllers, --enable-ppc-webhook, --enable-enoexec-event-controllers")
 	}
+	if initialLogLevel < 0 || initialLogLevel > 10 {
+		return fmt.Errorf("initial-log-level must be in range [0,10], got %d", initialLogLevel)
+	}
 	return nil
 }
 
@@ -319,11 +322,13 @@ func bindFlags() {
 	// This may be deprecated in the future. It is used to support the current way of setting the log level for operands
 	// If operands will start to support a controller that watches the ClusterPodPlacementConfig, this flag may be removed
 	// and the log level will be set in the ClusterPodPlacementConfig at runtime (with no need for reconciliation)
-	flag.IntVar(&initialLogLevel, "initial-log-level", common.LogVerbosityLevelNormal.ToZapLevelInt(), "Initial log level. Converted to zap")
+	flag.IntVar(&initialLogLevel, "initial-log-level", common.LogVerbosityLevelNormal.ToZapLevelInt(), "Initial log level (0-10). Converted to zap. CRD levels: 0=Normal, 1=Debug, 2=Trace, 3=TraceAll")
 	klog.InitFlags(nil)
 	flag.Parse()
 	// Set the Log Level as AtomicLevel to allow runtime changes
-	utils.AtomicLevel = zapuber.NewAtomicLevelAt(zapcore.Level(int8(-initialLogLevel))) // #nosec G115 -- initialLogLevel is constrained to 0-3 range
+	// Safe to convert: initialLogLevel is validated to be in range [0,10] by validateFlags(),
+	// so -initialLogLevel is in range [-10,0] which fits in int8 range [-128,127]
+	utils.AtomicLevel = zapuber.NewAtomicLevelAt(zapcore.Level(int8(-initialLogLevel))) //nolint:gosec // G115 - conversion is safe, value validated to be in range
 	zapLogger := zap.New(zap.Level(utils.AtomicLevel), zap.UseDevMode(false))
 	klog.SetLogger(zapLogger)
 	ctrllog.SetLogger(zapLogger)

config/crd/bases/multiarch.openshift.io_podplacementconfigs.yaml

@@ -90,9 +90,7 @@ spec:
                 type: object
                 x-kubernetes-map-type: atomic
               plugins:
-                description: |-
-                  Plugins defines the configurable plugins for this component.
-                  This field is required.
+                description: Plugins defines the configurable plugins for this component.
                 properties:
                   nodeAffinityScoring:
                     description: NodeAffinityScoring is the plugin that implements
@@ -144,8 +142,6 @@ spec:
                 maximum: 255
                 minimum: 0
                 type: integer
-            required:
-            - plugins
             type: object
           status:
             description: PodPlacementConfigStatus defines the observed state of PodPlacementConfig

hack/upgrade-automation/README.md

@@ -79,11 +79,10 @@ Updates all Go dependencies (smart handling skips incompatible versions):
 
 Re-vendors all dependencies:
 1. `go mod tidy`
-2. `rm -rf vendor/`
-3. `go mod vendor`
-4. Restores go directive if `go mod tidy` upgraded it
+2. `make vendor`
+3. Restores go directive if `go mod tidy` upgraded it
 
-**Commit:** `go mod vendor`
+**Commit:** `make vendor`
 
 ### Step 5: Run code generation
 
@@ -220,7 +219,7 @@ sed_inplace() {
 | `validate_prerequisites()` | All above checks | Exit on any failure |
 
 **Branch naming:**
-```
+```text
 upgrade-ocp-{ocp}-go-{go_minor}-k8s-{k8s_minor}
 
 Example: upgrade-ocp-4.20-go-1.24-k8s-1.34
@@ -277,19 +276,19 @@ hack/upgrade-automation/scripts/upgrade.sh 4.20 1.24 1.34.1
 **Common causes and fixes:**
 
 **API deprecation:**
-```
+```text
 Error: undefined: corev1.SomeOldAPI
 ```
 Solution: Update code to use new API (check K8s release notes)
 
 **Test helper changes:**
-```
+```text
 Error: cannot use X (type Y) as type Z
 ```
 Solution: Update test setup code for new types
 
 **Import path changes:**
-```
+```text
 Error: package X is not in GOROOT
 ```
 Solution: Update import paths (check go.mod for correct versions)

hack/upgrade-automation/scripts/lib/validations.sh

@@ -69,8 +69,8 @@ validate_and_create_branch() {
         read -p "Do you want to delete and recreate it? (y/N) " -n 1 -r >&2
         echo "" >&2
         if [[ $REPLY =~ ^[Yy]$ ]]; then
-            git branch -D "$branch_name"
-            git checkout -b "$branch_name"
+            # Use checkout -B to force recreation (works even if currently checked out)
+            git checkout -B "$branch_name"
         else
             echo "ERROR: Branch '$branch_name' already exists. Please delete it or choose a different version." >&2
             return 1
@@ -124,12 +124,12 @@ validate_k8s_version_consistency() {
     echo "Validating k8s.io version consistency in go.mod..." >&2
 
     local versions_count
-    versions_count=$(grep '^\s*k8s\.io/' go.mod | grep -v '//' | awk '{print $2}' | grep -oP 'v\d+\.\d+' | sort -u | wc -l)
+    versions_count=$(grep '^\s*k8s\.io/' go.mod | grep -v '//' | awk '{print $2}' | sed -E 's/(v[0-9]+\.[0-9]+).*/\1/' | sort -u | wc -l)
 
     if [[ "$versions_count" -gt 1 ]]; then
         echo "⚠️  WARNING: Multiple k8s.io minor versions detected in go.mod" >&2
         echo "   Found versions:" >&2
-        grep '^\s*k8s\.io/' go.mod | grep -v '//' | awk '{print $1, $2}' | grep -oP 'v\d+\.\d+' | sort -u >&2
+        grep '^\s*k8s\.io/' go.mod | grep -v '//' | awk '{print $1, $2}' | sed -E 's/.*(v[0-9]+\.[0-9]+).*/\1/' | sort -u >&2
         echo "   This is expected for packages like k8s.io/klog and k8s.io/utils" >&2
     else
         echo "✅ All k8s.io dependencies at consistent minor version" >&2
@@ -160,7 +160,7 @@ validate_prerequisites() {
     local current_go current_k8s current_ocp
     current_go=$(grep '^go ' go.mod | awk '{print $2}')
     current_k8s=$(grep 'k8s.io/api' go.mod | head -1 | awk '{print $2}')
-    current_ocp=$(grep 'BUILD_IMAGE' Makefile | grep -oP 'openshift-\K[0-9]+\.[0-9]+')
+    current_ocp=$(grep 'BUILD_IMAGE' Makefile | sed -E 's/.*openshift-([0-9]+\.[0-9]+).*/\1/')
 
     echo "Current versions:" >&2
     echo "  Go: $current_go" >&2
@@ -172,5 +172,17 @@ validate_prerequisites() {
     echo "  Kubernetes: $k8s_version" >&2
     echo "" >&2
 
+    # Validate golang image exists
+    if ! validate_golang_image_exists "$go_version"; then
+        return 1
+    fi
+
+    echo "" >&2
+
+    # Validate k8s version consistency (warning only)
+    validate_k8s_version_consistency
+
+    echo "" >&2
+
     return 0
 }

hack/upgrade-automation/scripts/lib/version-discovery.sh

@@ -23,12 +23,13 @@ discover_k8s_from_ocp_release() {
         echo "$k8s_version"
     else
         # Fallback: discover from openshift/api go.mod
-        local k8s_minor
-        k8s_minor=$(curl -sf "https://raw.githubusercontent.com/openshift/api/release-$ocp_version/go.mod" | \
-            grep 'k8s.io/api ' | awk '{print $2}' | grep -oP 'v0\.\K[0-9]+')
+        local k8s_module_version
+        k8s_module_version=$(curl -sf "https://raw.githubusercontent.com/openshift/api/release-$ocp_version/go.mod" | \
+            grep 'k8s.io/api ' | awk '{print $2}' | sed -E -n '/^v0\.[0-9]+\.[0-9]+$/p')
 
-        if [[ -n "$k8s_minor" ]]; then
-            echo "1.$k8s_minor.0"
+        if [[ -n "$k8s_module_version" ]]; then
+            # Transform v0.X.Y to 1.X.Y (preserving patch version)
+            echo "${k8s_module_version/v0./1.}"
         else
             echo ""
         fi
@@ -74,7 +75,7 @@ discover_required_ocp_version() {
     # Check each branch to find which uses our target K8s version
     for ocp_version in $branches; do
         local openshift_api_k8s
-        openshift_api_k8s=$(curl -sf "https://raw.githubusercontent.com/openshift/api/release-$ocp_version/go.mod" | grep 'k8s.io/api ' | awk '{print $2}' | grep -oP 'v0\.\K[0-9]+')
+        openshift_api_k8s=$(curl -sf "https://raw.githubusercontent.com/openshift/api/release-$ocp_version/go.mod" | grep 'k8s.io/api ' | awk '{print $2}' | sed -E 's/^v0\.([0-9]+).*/\1/')
 
         if [[ "$openshift_api_k8s" == "$k8s_minor" ]]; then
             echo "✅ Found OCP $ocp_version uses K8s 1.$k8s_minor" >&2
@@ -113,7 +114,7 @@ validate_k8s_ocp_compatibility() {
 
     # Check openshift/api release branch for K8s version
     local openshift_api_k8s
-    openshift_api_k8s=$(curl -sf "https://raw.githubusercontent.com/openshift/api/release-$ocp_version/go.mod" | grep 'k8s.io/api ' | awk '{print $2}' | grep -oP 'v0\.\K[0-9]+')
+    openshift_api_k8s=$(curl -sf "https://raw.githubusercontent.com/openshift/api/release-$ocp_version/go.mod" | grep 'k8s.io/api ' | awk '{print $2}' | sed -E 's/^v0\.([0-9]+).*/\1/')
 
     if [[ "$openshift_api_k8s" != "$k8s_minor" ]]; then
         echo "ERROR: K8s version mismatch" >&2
@@ -139,7 +140,7 @@ discover_controller_runtime_version() {
     echo "Discovering compatible controller-runtime version..." >&2
 
     local releases
-    releases=$(curl -s https://api.github.com/repos/kubernetes-sigs/controller-runtime/releases | grep '"tag_name"' | grep -E '"v0\.' | sed -E 's/.*"v([^"]+)".*/\1/')
+    releases=$(curl -s https://api.github.com/repos/kubernetes-sigs/controller-runtime/releases | grep '"tag_name"' | grep -E '"v0\.' | grep -Ev -- '-(alpha|beta|rc)[0-9.]*"' | sed -E 's/.*"v([^"]+)".*/\1/')
 
     for version in $releases; do
         local gomod
@@ -150,7 +151,7 @@ discover_controller_runtime_version() {
         fi
 
         local cr_k8s_minor cr_go_minor
-        cr_k8s_minor=$(echo "$gomod" | grep 'k8s.io/apimachinery' | awk '{print $2}' | grep -oP 'v0\.\K[0-9]+' | head -1)
+        cr_k8s_minor=$(echo "$gomod" | grep 'k8s.io/apimachinery' | awk '{print $2}' | sed -E 's/^v0\.([0-9]+).*/\1/' | head -1)
         cr_go_minor=$(echo "$gomod" | grep '^go ' | awk '{print $2}' | cut -d. -f2)
 
         if [[ "$cr_k8s_minor" == "$k8s_minor" ]] && [[ "$cr_go_minor" -le "$go_minor" ]]; then
@@ -200,13 +201,13 @@ discover_controller_tools_version() {
 
     local k8s_minor go_minor
     # Extract minor version from k8s_version parameter (e.g., "1.34.1" -> "34")
-    k8s_minor=$(echo "$k8s_version" | grep -oP '1\.\K[0-9]+')
+    k8s_minor=$(echo "$k8s_version" | sed -E 's/^1\.([0-9]+).*/\1/')
     go_minor=$(echo "$go_version" | cut -d. -f2)
 
     echo "Discovering compatible controller-tools version..." >&2
 
     local releases
-    releases=$(curl -s https://api.github.com/repos/kubernetes-sigs/controller-tools/releases | grep '"tag_name"' | grep -E '"v0\.' | sed -E 's/.*"v([^"]+)".*/\1/')
+    releases=$(curl -s https://api.github.com/repos/kubernetes-sigs/controller-tools/releases | grep '"tag_name"' | grep -E '"v0\.' | grep -Ev -- '-(alpha|beta|rc)[0-9.]*"' | sed -E 's/.*"v([^"]+)".*/\1/')
 
     for version in $releases; do
         local gomod
@@ -217,7 +218,7 @@ discover_controller_tools_version() {
         fi
 
         local ct_k8s_minor ct_go_minor
-        ct_k8s_minor=$(echo "$gomod" | grep 'k8s.io/apimachinery' | awk '{print $2}' | grep -oP 'v0\.\K[0-9]+' | head -1)
+        ct_k8s_minor=$(echo "$gomod" | grep 'k8s.io/apimachinery' | awk '{print $2}' | sed -E 's/^v0\.([0-9]+).*/\1/' | head -1)
         ct_go_minor=$(echo "$gomod" | grep '^go ' | awk '{print $2}' | cut -d. -f2)
 
         if [[ "$ct_k8s_minor" == "$k8s_minor" ]] && [[ "$ct_go_minor" -le "$go_minor" ]]; then
@@ -292,7 +293,7 @@ discover_golangci_lint_version() {
     echo "Discovering compatible golangci-lint version..." >&2
 
     local releases
-    releases=$(curl -s https://api.github.com/repos/golangci/golangci-lint/releases | grep '"tag_name"' | sed -E 's/.*"v([^"]+)".*/\1/')
+    releases=$(curl -s https://api.github.com/repos/golangci/golangci-lint/releases | grep '"tag_name"' | grep -Ev -- '-(alpha|beta|rc)[0-9.]*"' | sed -E 's/.*"v([^"]+)".*/\1/')
 
     for version in $releases; do
         local go_req