OCPBUGS-83863: Remove RHEL 8 binary build from Dockerfile

[sdodson]

Summary

• Remove the rhel8 multi-stage build that compiled a second set of binaries with the RHEL 8 Go toolchain
• Remove RHEL 8 shim copies (/usr/libexec/cni/rhel8/ovn-k8s-cni-overlay, /usr/lib/rhel8/ovnkube-trace) from the final image
• Apply -w -s LDFLAGS to all binary builds (including ovnkube) to strip debug info and reduce image size
• Add /usr/libexec/cni/rhel9/ and /usr/libexec/cni/rhel10/ directories with hard links to the single ovn-k8s-cni-overlay binary so the CNO's ovnkube-node startup script can find the right binary for each RHEL version

Test plan

• Verify the image builds successfully without the rhel8 stage
• Verify RHEL 9 nodes get the correct CNI binary from /usr/libexec/cni/rhel9/
• Verify RHEL 10 nodes get the correct CNI binary from /usr/libexec/cni/rhel10/
• Confirm no RHEL 8 nodes remain in supported clusters
• Verify stripped binaries function correctly

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Final container image now ships only RHEL‑9 runtime components; RHEL‑8 runtime shims removed.
  • CNI layout consolidated: RHEL‑9 and RHEL‑10 directories point to a single built CNI binary via hard links.
  • Build pipeline simplified to produce and package a single set of runtime artifacts, reducing image size and surface area.
  • Linker flags standardized across builds to produce smaller, stripped binaries for consistent outputs.

[openshift-ci-robot]

@sdodson: This pull request references Jira Issue OCPBUGS-83870, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

• Remove the rhel8 multi-stage build that compiled a second set of binaries with the RHEL 8 Go toolchain
• Remove RHEL 8 shim copies (/usr/libexec/cni/rhel8/ovn-k8s-cni-overlay, /usr/lib/rhel8/ovnkube-trace) from the final image
• Retain the rhel9/ directory structure so future RHEL versions (10, 11) can be added by introducing a new build stage

Test plan

• Verify the image builds successfully without the rhel8 stage
• Verify RHEL 9 nodes get the correct CNI shim from /usr/libexec/cni/rhel9/
• Confirm no RHEL 8 nodes remain in supported clusters

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Enterprise

Run ID: ca1edf57-8609-485a-afaa-bbcef2c703ad

📥 Commits

Reviewing files that changed from the base of the PR and between e9d510d and f0b23c7.

📒 Files selected for processing (2)

• Dockerfile
• go-controller/hack/build-go.sh

🚧 Files skipped from review as they are similar to previous changes (1)

• go-controller/hack/build-go.sh

---

Walkthrough

Removed the RHEL‑8 build stage and RHEL‑8 artifact copies from the Dockerfile; final image is produced from the RHEL‑9 builder and now creates /usr/libexec/cni/rhel9 and /usr/libexec/cni/rhel10 pointing via hard links to the single built CNI. Build script now unconditionally injects ${LDFLAGS} (e.g., -w -s) into all -ldflags, including Windows builds.

Changes

Cohort / File(s)	Summary
Dockerfile - builder and artifact layout Dockerfile	Removed rhel8 build stage and its artifact copy steps; go-controller builder adds stripped linker flags (LDFLAGS="-w -s") to built binaries. Final image creates /usr/libexec/cni/rhel9 and /usr/libexec/cni/rhel10 and uses hard links to a single ovn-k8s-cni-overlay instead of separate RHEL‑8 artifacts; ovnkube-trace RHEL‑8 install removed.
Build script - unconditional LDFLAGS go-controller/hack/build-go.sh	Replaced conditional command-substitution logic so ${LDFLAGS} is now appended unconditionally to -ldflags for native and Windows builds; all binaries (including ovnkube) receive ${LDFLAGS} during linking.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 I nibbled stage eight from the stack,
Linked flags in place, no turning back.
One CNI to rule both nine and ten,
Binaries lighter — hop again, my friend! 🥕

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: removing RHEL 8 binary build from Dockerfile, which aligns with the primary objective of the PR.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci-robot]

@sdodson: This pull request references Jira Issue OCPBUGS-83870, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

Summary

• Remove the rhel8 multi-stage build that compiled a second set of binaries with the RHEL 8 Go toolchain
• Remove RHEL 8 shim copies (/usr/libexec/cni/rhel8/ovn-k8s-cni-overlay, /usr/lib/rhel8/ovnkube-trace) from the final image
• Retain the rhel9/ directory structure so future RHEL versions (10, 11) can be added by introducing a new build stage

Test plan

• Verify the image builds successfully without the rhel8 stage
• Verify RHEL 9 nodes get the correct CNI shim from /usr/libexec/cni/rhel9/
• Confirm no RHEL 8 nodes remain in supported clusters

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
• Removed RHEL-8 binary support from the container image. The image now exclusively includes RHEL-9 components, streamlining the build process.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sdodson
Once this PR has been reviewed and has the lgtm label, please assign martinkennelly for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@sdodson: This pull request references Jira Issue OCPBUGS-83868, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

• Remove the rhel8 multi-stage build that compiled a second set of binaries with the RHEL 8 Go toolchain
• Remove RHEL 8 shim copies (/usr/libexec/cni/rhel8/ovn-k8s-cni-overlay, /usr/lib/rhel8/ovnkube-trace) from the final image
• Retain the rhel9/ directory structure so future RHEL versions (10, 11) can be added by introducing a new build stage

Test plan

• Verify the image builds successfully without the rhel8 stage
• Verify RHEL 9 nodes get the correct CNI shim from /usr/libexec/cni/rhel9/
• Confirm no RHEL 8 nodes remain in supported clusters

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
• Removed RHEL‑8 runtime artifacts and shim binaries from the container image; the final image now contains only RHEL‑9 components.
• Simplified the build output and packaging so only RHEL‑9-built binaries are included, reducing image contents and streamlining the build pipeline.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@sdodson: This pull request references Jira Issue OCPBUGS-83863, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

• Remove the rhel8 multi-stage build that compiled a second set of binaries with the RHEL 8 Go toolchain
• Remove RHEL 8 shim copies (/usr/libexec/cni/rhel8/ovn-k8s-cni-overlay, /usr/lib/rhel8/ovnkube-trace) from the final image
• Retain the rhel9/ directory structure so future RHEL versions (10, 11) can be added by introducing a new build stage

Test plan

• Verify the image builds successfully without the rhel8 stage
• Verify RHEL 9 nodes get the correct CNI shim from /usr/libexec/cni/rhel9/
• Confirm no RHEL 8 nodes remain in supported clusters

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
• Removed RHEL‑8 runtime artifacts and shim binaries from the container image; the final image now contains only RHEL‑9 components.
• Simplified the build output and packaging so only RHEL‑9-built binaries are included, reducing image contents and streamlining the build pipeline.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[sdodson]

/hold
Need to test all of these together

[openshift-ci]

@sdodson: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/security	f0b23c7	link	false	/test security
ci/prow/e2e-aws-ovn-upgrade	f0b23c7	link	true	/test e2e-aws-ovn-upgrade
ci/prow/e2e-metal-ipi-ovn-dualstack	f0b23c7	link	true	/test e2e-metal-ipi-ovn-dualstack
ci/prow/e2e-azure-ovn-upgrade	f0b23c7	link	true	/test e2e-azure-ovn-upgrade
ci/prow/e2e-metal-ipi-ovn-dualstack-bgp	f0b23c7	link	true	/test e2e-metal-ipi-ovn-dualstack-bgp
ci/prow/e2e-metal-ipi-ovn-dualstack-bgp-local-gw	f0b23c7	link	true	/test e2e-metal-ipi-ovn-dualstack-bgp-local-gw
ci/prow/e2e-aws-ovn-upgrade-local-gateway	f0b23c7	link	true	/test e2e-aws-ovn-upgrade-local-gateway
ci/prow/e2e-metal-ipi-ovn-ipv6	f0b23c7	link	true	/test e2e-metal-ipi-ovn-ipv6
ci/prow/e2e-aws-ovn-rhcos10-techpreview	f0b23c7	link	false	/test e2e-aws-ovn-rhcos10-techpreview

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.