OCPBUGS-120824: Remove redundant iproute installation from hyperkube image

[sdodson]

The hyperkube Dockerfile explicitly installs iproute, but the current base-rhel9 image already provides it.

ss is still used by the cluster-kube-apiserver-operator static-pod startup entrypoint as a fallback when kubelet or CRI-O overlaps the old and new kube-apiserver containers. This change removes only the redundant image-local installation; the package remains inherited from the base image.

Fixes OCPBUGS-120824

Summary by CodeRabbit

• Bug Fixes
  • Removed the image build step that installed and cleaned up the iproute package in the RHEL-based image.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@sdodson: This pull request references Jira Issue OCPBUGS-120824, which is invalid:

• expected the bug to target the "5.1.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Removes the redundant iproute installation from the hyperkube image.

The package was added for ss during API server startup, but no executable from its RPM is used by the current image payload.

The base image still includes iproute; this removes only the image-local installation.

Fixes OCPBUGS-120824

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@sdodson: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 393bff7|OCPBUGS-120824: Remove unused iproute from hyperkube image: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b8bb01e0-f778-42bf-8921-06ede57b4cde

📥 Commits

Reviewing files that changed from the base of the PR and between fb553cd and 393bff7.

📒 Files selected for processing (1)

• openshift-hack/images/hyperkube/Dockerfile.rhel

💤 Files with no reviewable changes (1)

• openshift-hack/images/hyperkube/Dockerfile.rhel

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

Walkthrough

The RHEL hyperkube image build no longer installs iproute or cleans package metadata before copying built binaries.

Changes

Hyperkube RHEL image

Layer / File(s)	Summary
Remove iproute installation openshift-hack/images/hyperkube/Dockerfile.rhel	The Dockerfile removes the yum command that installed iproute and cleaned package metadata.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 393bf

This change removes a redundant image-local iproute installation while retaining the base image package. No current merge-readiness risk is identified.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS. The commit changes only openshift-hack/images/hyperkube/Dockerfile.rhel and removes one iproute installation line. It adds or changes no Ginkgo test titles or test files.
Test Structure And Quality	✅ Passed	PASS: The pull request changes only openshift-hack/images/hyperkube/Dockerfile.rhel. The diff removes one yum installation line and changes no Ginkgo test code, It blocks, setup/cleanup, waits, …
Microshift Test Compatibility	✅ Passed	PASS: The pull request changes only openshift-hack/images/hyperkube/Dockerfile.rhel and removes one yum install line. It adds no Ginkgo e2e tests, unavailable API references, namespaces, or MicroS…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only openshift-hack/images/hyperkube/Dockerfile.rhel. The diff removes one iproute installation line and adds no Ginkgo e2e tests or test code. Therefore, the SNO test com…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS. The commit changes only openshift-hack/images/hyperkube/Dockerfile.rhel and removes one yum install instruction for iproute. It does not add or modify deployment manifests, operators, cont…
Ote Binary Stdout Contract	✅ Passed	PASS: The pull request changes only openshift-hack/images/hyperkube/Dockerfile.rhel. The diff removes one yum install ... iproute line. It does not change main(), suite setup, logging, or any OT…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The pull request changes only one line in openshift-hack/images/hyperkube/Dockerfile.rhel: it removes the image-local iproute installation. The HEAD^..HEAD diff contains no Go files and adds no …
No-Weak-Crypto	✅ Passed	PASS: The commit changes only openshift-hack/images/hyperkube/Dockerfile.rhel and deletes the yum install ... iproute command. The diff adds no MD5, SHA1, DES, 3DES, RC4, Blowfish, ECB, custom cry…
Container-Privileges	✅ Passed	PASS — The pull request changes only one Dockerfile line and removes the iproute installation. The final stage still uses the same base image and contains no privileged, host namespace, `SYS_ADMIN…
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The pull request only deletes the yum install ... iproute && yum clean all line from openshift-hack/images/hyperkube/Dockerfile.rhel. It adds no logging, credentials, identifiers, or custome…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: removing the redundant iproute installation from the hyperkube image. It also includes the related issue identifier.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci-robot]

@sdodson: This pull request references Jira Issue OCPBUGS-120824, which is invalid:

• expected the bug to target the "5.1.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

The hyperkube Dockerfile explicitly installs iproute, but the current base-rhel9 image already provides it.

ss is still used by the cluster-kube-apiserver-operator static-pod startup entrypoint as a fallback when kubelet or CRI-O overlaps the old and new kube-apiserver containers. This change removes only the redundant image-local installation; the package remains inherited from the base image.

Fixes OCPBUGS-120824

Summary by CodeRabbit

• Bug Fixes
• Removed the image build step that installed and cleaned up the iproute package in the RHEL-based image.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[sdodson]

/hold
ss still used in the kube-apiserver pod spec

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jubittajohn, sdodson

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• DOWNSTREAM_OWNERS [jubittajohn]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@sdodson: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/verify	393bff7	link	true	/test verify
ci/prow/okd-scos-images	393bff7	link	true	/test okd-scos-images
ci/prow/images	393bff7	link	true	/test images
ci/prow/unit	393bff7	link	true	/test unit
ci/prow/perfscale-control-plane-6nodes	393bff7	link	false	/test perfscale-control-plane-6nodes
ci/prow/integration	393bff7	link	true	/test integration

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.