ROSAENG-4015: Update ethtool exporter images from 4.16 to 4.21

[nephomaniac]

Summary

• Update supplemental ethtool node-exporter and kube-rbac-proxy images to match CMO node-exporter
  images running on 4.21.16 MCs
• The current stop-gap deployment is functioning correctly — this update is proactive maintenance
  to keep the images aligned with the CMO node-exporter images running on the MCs
• All 13 production MCs verified to be running identical images on OCP 4.21.16
• Image updates:
  • node-exporter: sha256:85765701... -> sha256:f4d6a42d...
  • kube-rbac-proxy: sha256:82f5ad5a... -> sha256:731316e9...

Note: Draft Status

This PR is marked as draft pending manual validation. The updated images need to be
manually applied and verified on an integration or staging MC before this PR is ready
for merge. Validation should confirm:

• DaemonSet pods start and run without errors
• Scrape targets are healthy
• Only the expected *_allowance_exceeded metrics are collected
• No interference with CMO / openshift-monitoring
• Pod resource consumption is reasonable

Once validated, this PR can be marked ready for review and promoted through the
standard integration -> staging -> production pipeline.

Note: Upstream CMO ethtool collector support

RFE-7342 (Enable the ethtool collector
for OpenShift Monitoring Node Exporter) is still in Refinement. The CMO configuration
support has landed upstream via CMO#2779,
but only for OCP 4.22+. The MCs are currently running 4.21.16 and are not yet on a
version that supports the native CMO ethtool collector. This supplemental node-exporter
remains necessary until the MCs upgrade to 4.22, at which point ROSAENG-1211
tracks removing this stop-gap and configuring the CMO-native collector instead.

Related

• Jira: ROSAENG-4015
• Original deployment: managed-cluster-config#2495
• Upstream RFE: RFE-7342 (status: Refinement)
• Deprecation tracker: ROSAENG-1211

🤖 Generated with Claude Code

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci-robot]

@nephomaniac: This pull request references ROSAENG-4015 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Update supplemental ethtool node-exporter and kube-rbac-proxy images to match CMO node-exporter
  images running on 4.21.16 MCs
• All 13 production MCs verified to be running identical images on OCP 4.21.16
• Image updates:
• node-exporter: sha256:85765701... -> sha256:f4d6a42d...
• kube-rbac-proxy: sha256:82f5ad5a... -> sha256:731316e9...

Note: Draft Status

This PR is marked as draft pending manual validation. The updated images need to be
manually applied and verified on an integration or staging MC before this PR is ready
for merge. Validation should confirm:

• DaemonSet pods start and run without errors
• Scrape targets are healthy
• Only the expected *_allowance_exceeded metrics are collected
• No interference with CMO / openshift-monitoring
• Pod resource consumption is reasonable

Once validated, this PR can be marked ready for review and promoted through the
standard integration -> staging -> production pipeline.

Note: Upstream CMO ethtool collector support

RFE-7342 (Enable the ethtool collector
for OpenShift Monitoring Node Exporter) is still in Refinement. The CMO configuration
support has landed upstream via CMO#2779,
but only for OCP 4.22+. The MCs are currently running 4.21.16 and are not yet on a
version that supports the native CMO ethtool collector. This supplemental node-exporter
remains necessary until the MCs upgrade to 4.22, at which point ROSAENG-1211
tracks removing this stop-gap and configuring the CMO-native collector instead.

Related

• Jira: ROSAENG-4015
• Original deployment: managed-cluster-config#2495
• Upstream RFE: RFE-7342 (status: Refinement)
• Deprecation tracker: ROSAENG-1211

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: nephomaniac
Once this PR has been reviewed and has the lgtm label, please assign ajpantuso for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Walkthrough

The DaemonSet’s three container image digests and associated source comments are updated from PROD 4.16.42 references to PROD 4.21.16 references. No runtime configuration or deployment behavior changes.

Changes

EtHTool exporter image refresh

Layer / File(s)	Summary
Refresh DaemonSet container images deploy/srep-1000-ethtool-exporter/09-DaemonSet.yaml	Updates the pinned digests and source annotations for the ethtool-exporter, kube-rbac-proxy, and init-textfile images.

Estimated code review effort: 1 (Trivial) | ~5 minutes

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Container-Privileges	❌ Error	Manifest still sets hostNetwork:true, hostPID:true, and initContainer privileged:true/runAsUser:0; it fails the container-privileges check.	Remove or explicitly justify these settings, or exempt this DaemonSet with documented need; keep allowPrivilegeEscalation false and drop all caps.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR only updates DaemonSet image digests/comments and config templates; no Ginkgo test titles or test files were changed.
Test Structure And Quality	✅ Passed	PR only changes manifests/templates with image digest updates; no Ginkgo tests or test logic changed, so this check is not applicable.
Microshift Test Compatibility	✅ Passed	No new Ginkgo/e2e tests were added; the diff only updates YAML manifests and templates with image digests.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR only updates YAML manifests/image digests; no Ginkgo tests or SNO-sensitive code was added, so the SNO compatibility check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	Diff is image/comment only; no nodeSelector, affinity, tolerations, replicas, or topology-spread changes were introduced.
Ote Binary Stdout Contract	✅ Passed	Only image digests/comments changed; no process-level stdout writes were added, and no source hooks were present.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No Ginkgo e2e tests were added; the PR only updates DaemonSet/manifests and templates, so IPv6/disconnected test compatibility is not applicable.
No-Weak-Crypto	✅ Passed	Diff only updates sha256 image digests/comments and keeps modern TLS cipher suites; no MD5/SHA1/DES/RC4/3DES/ECB or custom crypto added.
No-Sensitive-Data-In-Logs	✅ Passed	The PR only updates image digests/comments; no new logs or sensitive data are introduced, and the existing echo logs only CPU/GOMAXPROCS values.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: updating ethtool exporter images from OCP 4.16 to 4.21.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[joshbranham]

@nephomaniac just a heads up that 4.22 upgrades are in flight so you might be able to remove this whole stack once that is done and enable the native collector