Skip to content

butane: report CEX kernel arg error once when both sources set - #2294

Merged
prestist merged 2 commits into
coreos:mainfrom
deepak0x:fix/2285-dup-cex-error
Oct 2, 2026
Merged

prestist merged 2 commits into
coreos:mainfrom
deepak0x:fix/2285-dup-cex-error

Conversation

@deepak0x

@deepak0x deepak0x commented Aug 18, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Config.Validate in butane/config/openshift/v4_23_exp/validate.go reported ErrMissingKernelArgumentCex twice at $.openshift.kernel_arguments when both boot_device.luks.cex.enabled: true and a storage.luks root entry with cex.enabled: true were set.

Two independent if-blocks each called r.AddOnError(...) when the rd.luks.key=/etc/luks/cex.key kernel argument was absent, so both fired and the identical error was reported twice.

Fix

Consolidate the two checks into a single cex flag (set when either the boot-device CEX is enabled or any root storage.luks entry has CEX enabled) and emit the error exactly once when the flag is set and the kernel argument is missing. Behavior and error path are unchanged.

Test plan

  • Added a TestValidateConfig case that sets both CEX sources and an empty kernel argument list, asserting exactly one ErrMissingKernelArgumentCex at $.openshift.kernel_arguments.
  • Verified the new test fails on the old code (two entries) and passes on the fixed code (one entry).
  • go test ./butane/config/openshift/v4_23_exp/... passes.

Fixes #2285


This PR ports the fix originally opened as coreos/butane#732 for coreos/butane#731, before butane was merged into ignition. It supersedes that PR and closes coreos/butane#731.

cc @prestist

@coderabbitai

coderabbitai Bot commented Aug 18, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository: coreos/ignition/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: e006bbaf-bfea-4333-859e-a3ca674aa64e

📥 Commits

Reviewing files that changed from the base of the PR and between c1f29c8 and 8c92754.

📒 Files selected for processing (1)
  • docs/release-notes.md
🚧 Files skipped from review as they are similar to previous changes (1)
  • docs/release-notes.md

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (9)
  • GitHub Check: Build butane container image
  • GitHub Check: Build container image
  • GitHub Check: Test ignition-validate (1.26.x, windows-latest)
  • GitHub Check: Check binary size
  • GitHub Check: Test (1.25.x)
  • GitHub Check: Test (1.26.x)
  • GitHub Check: Test ignition-validate (1.26.x, macos-latest)
  • GitHub Check: tmt-tests
  • GitHub Check: Shellcheck

📝 Walkthrough

Walkthrough

OpenShift 4.23 validation now combines boot-device and root-storage CEX settings before checking for the required kernel argument. A regression test checks for one error, and the release notes document the change.

Changes

CEX validation

Layer / File(s) Summary
Combine CEX validation state
butane/config/openshift/v4_23_exp/validate.go
CEX state includes the boot-device setting before storage entries are scanned. The missing kernel-argument check runs once after both sources are evaluated.
Regression coverage and release note
butane/config/openshift/v4_23_exp/validate_test.go, docs/release-notes.md
A test with both CEX settings expects exactly one missing kernel-argument error. The release notes document the fix.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: prestist

Merge Risk: ⚪ Minimal · up to 8c927

The change removes duplicate CEX validation errors without weakening the required kernel-argument check. No actionable merge-blocking risk remains, subject to normal checks.

🚥 Pre-merge checks | ✅ 5 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (1 skipped: 1 … Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title uses the required subsystem: lowercase description format, uses imperative mood, and has no trailing period. The CEX acronym is appropriately uppercase.
Description check ✅ Passed The description clearly explains the duplicate CEX kernel-argument error, the code fix, the added test, and the validation performed.
Linked Issues check ✅ Passed The PR satisfies active issue #2285. Config.Validate initializes one cex flag from boot_device.luks.cex.enabled, adds root storage.luks CEX entries to that flag, and performs one missing-argum…
Out of Scope Changes check ✅ Passed The validation change directly fixes the duplicate error in #2285. The test verifies the fix. The release-note entry documents the same fix. No unrelated change is demonstrated.
Commit Message Convention ✅ Passed Both non-merge commits comply. Their subjects are butane: report CEX kernel arg error once when both sources set and butane: merge conditional cex assignment to satisfy staticcheck QF1007. Each us…
Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (1 skipped: 1 unsupported.)

  • Fix all pre-merge checks with AI
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create a new PR

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Sep 14, 2026 •

Copy link
Copy Markdown

Binary size report (bin/amd64/ignition)

Size
Base (main) 33MiB
PR (#2294) 33MiB
Delta +80B (0.00%)

@prestist

Copy link
Copy Markdown
Collaborator

Hmm, it looks like we have some failures, the tmt tests are fixed if you re-base, however the go tests are actual linting issues.

@deepak0x

Copy link
Copy Markdown
Contributor Author

Done — the lint issue was staticcheck QF1007 on validate.go:54: the separate cex := false / if ... { cex = true } triggered 'could merge conditional assignment into variable declaration'. Replaced with a direct initialization cex := util.IsTrue(...) from the first condition (3 lines shorter, same logic). Tests pass locally, pushed as b210c8ef.

@deepak0x
deepak0x force-pushed the fix/2285-dup-cex-error branch from b210c8e to c1f29c8 Compare September 16, 2026 12:30
@deepak0x

Copy link
Copy Markdown
Contributor Author

Rebased onto main to clear the merge conflict in docs/release-notes.md (kept both entries). The staticcheck QF1007 fix rides on top, force-pushed as c1f29c8.

@prestist

prestist commented Oct 1, 2026

Copy link
Copy Markdown
Collaborator

LGTM, thanks for the fix (and apologies for the delay). There is a large number of PRs right now, and its causing alot of pain with release notes. Sorry about that, we will try and reduce that soon. Another rebase will be needed once Pending pr lands.

When both boot_device.luks.cex.enabled and a storage.luks root entry
with cex.enabled are set, the missing 'rd.luks.key=/etc/luks/cex.key'
kernel argument was reported twice at $.openshift.kernel_arguments.

Consolidate the two independent checks into a single CEX-enabled flag
and emit the error exactly once. Behavior and error path are unchanged.

Fixes coreos#2285

Signed-off-by: Deepak Bhagat <[email protected]>
The separate cex := false / if ... { cex = true } pattern triggers the
staticcheck QF1007 'could merge conditional assignment into variable
declaration' lint. Replace with a direct initialization from the first
condition.

Signed-off-by: Deepak Bhagat <[email protected]>
@deepak0x
deepak0x force-pushed the fix/2285-dup-cex-error branch from c1f29c8 to 8c92754 Compare October 1, 2026 22:42
@prestist
prestist enabled auto-merge October 2, 2026 16:15
@prestist
prestist merged commit e3a20f3 into coreos:main Oct 2, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

2 participants