Add Antrea compatibility scraper

[zbzbdzb]

Antrea is missing from Console's compatibility registry. This adds a scraper and generated table that match each stable antrea Helm appVersion to the Kubernetes minimum documented in that application's tagged README, preserving historical changes instead of applying today's prerequisites to every release.

Sources:

• Official Helm installation guide and chart index: Helm releases start at v1.8.
• Tagged prerequisites: v1.15.2 requires 1.16 or later, v2.0.0 requires 1.19 or later, and v2.7.0 requires 1.23 or later.

The explicit or later policy is expanded through the repository's current KUBE_VERSION (1.36). This represents upstream's documented policy; it is not a claim that I ran Antrea across all those cluster versions. NodeIPAM, Open vSwitch, OS-specific and optional-feature prerequisites still apply as documented upstream. Pre-Helm versions and prereleases are excluded. A missing or ambiguous tagged README aborts before writing any partial update.

Validation completed locally:

• Six unit tests pass, covering appVersion/tag selection, patch-level prerequisite changes, version filtering, invalid/missing sources, bounds and the scrape entry point's failure atomicity.
• A real scrape and Helm 3.18.6 render completed. The shared updater's existing reduction policy produced 16 representative version rows (v1.8.0 through v2.7.0), all with image references.
• The generated table and manifest pass the repository's JSON Schema. The registry contains exactly one Antrea entry; git diff --check is clean.

A focused GitHub Actions workflow runs the unit tests, and utils/compatibility/tests/ANTREA.md documents sources, limitations and reproduction. No hosted CI result is claimed yet.

Please consider this submission under the README Contributor Program for new compatibility scrapers. Reward eligibility remains subject to maintainer review and merge.

[soffi-ai]

Soffi AI Summary

This PR adds Antrea to the Console compatibility registry, which was previously missing. The goal is to let Console accurately surface which Kubernetes versions each Antrea release supports, sourced directly from Antrea's tagged README prerequisites rather than applying a single blanket policy across all releases.

The implementation includes a Python scraper that fetches Kubernetes minimum requirements from each Antrea release's tagged README (preserving historical breakpoints — e.g., v1.8–v1.14 require Kubernetes ≥1.16, v1.15–v2.4 require ≥1.19, and v2.5+ require ≥1.23), generates the compatibility YAML, and registers it in the manifest. Pre-Helm releases (<v1.8) and pre-releases are excluded. A focused GitHub Actions workflow runs the scraper's six unit tests on every push, and a ANTREA.md doc captures sources, limitations, and reproduction steps.

Changes

Antrea compatibility data

• Adds the Antrea CNI plugin to the Console compatibility registry. Introduces a Python scraper that reads Kubernetes minimum prerequisites from each stable Antrea release's tagged README, generates static/compatibilities/antrea.yaml covering v1.8.0 through v2.7.0 (with historically accurate Kubernetes version ranges), registers the entry in manifest.yaml, adds six unit tests, and wires up a GitHub Actions workflow to run them on CI. (899a165)

---

Updated: 2026-09-08 09:44 UTC

Deploy in Soffi

[greptile-apps]

Greptile Summary

This PR adds Antrea to the compatibility registry and introduces a scraper that derives Kubernetes minimum versions from each stable release’s tagged README.

• Registers Antrea and adds generated compatibility rows with chart and image metadata.
• Adds strict, failure-atomic parsing and focused unit coverage.
• Adds a dedicated GitHub Actions workflow for the scraper tests.
• The workflow should use the repository-required test entry point and pin its action dependencies.

Confidence Score: 4/5

The scraper and generated compatibility data appear sound, but the repository’s required test invocation must be adopted before merge; action SHA pinning is additional non-blocking security hardening.

No functional defect was established in the scraper or generated registry data. The remaining findings are the workflow’s concrete violation of the repository test-command requirement and its use of mutable action references.

Files Needing Attention: .github/workflows/test-antrea-compatibility.yaml

Security Review

The new workflow uses mutable major-version references for two executable GitHub Actions. Its read-only permissions limit exposure, but full commit-SHA pinning would prevent silent tag movement from changing the code executed by CI.

Important Files Changed

Filename	Overview
utils/compatibility/scrapers/antrea.py	Adds strict per-release prerequisite parsing and constructs stable Antrea compatibility rows before invoking the shared updater.
utils/compatibility/tests/test_antrea.py	Covers release selection, version filtering, changed patch prerequisites, malformed sources, bounds validation, and failure atomicity.
static/compatibilities/antrea.yaml	Adds generated Antrea compatibility data spanning the supported Helm releases and documented Kubernetes lower bounds.
static/compatibilities/manifest.yaml	Registers the Antrea scraper with the compatibility updater.
.github/workflows/test-antrea-compatibility.yaml	Adds focused CI coverage but bypasses the required repository test entry point and references executable actions through mutable tags.
utils/compatibility/tests/ANTREA.md	Documents the upstream sources, compatibility interpretation, limitations, tests, and regeneration procedure.

_{Reviews (1): Last reviewed commit: "Add Antrea compatibility scraper and ver..." | Re-trigger Greptile}

[greptile-apps]

Required test entry point bypassed

This workflow invokes python -m unittest directly, but the repository directive requires tests to run through make test-full, using TEST_CMD when an override is needed. Route this job through that required test entry point before merging so it uses the repository's standard test environment.

Context Used: CLAUDE.md (source)

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[zbzbdzb]

Addressed in 53db0ec. The workflow now calls make test-full with the focused test command. This checkout's Compose file actually reads CONSOLE_CMD, so the workflow also supplies that variable, quoted as a single argument for /bin/sh -c. The existing Alpine test image does not include Python, so the disposable container installs Python and packaging in a temporary venv before running the six tests. The Make target retains dependency startup, exit-code propagation and teardown. YAML and command argument checks passed; the Docker wrapper has not been executed locally because Make and Docker are unavailable on this Windows host. Hosted execution still depends on maintainer approval.

[greptile-apps]

Mutable actions execute in CI

The workflow executes actions/checkout and actions/setup-python through mutable major-version tags. If either tag is repointed or its publisher is compromised, replacement code can run in this job. Pin both actions to full commit SHAs to make the executed code immutable. The read-only permissions limit the impact, but do not prevent compromised action code from running.

How this was verified: Both newly added action steps reference mutable tags and execute before the tests with access to the checked-out repository and read-only workflow token.

[zbzbdzb]

Addressed in 53db0ec. Checkout is pinned to the verified v6 commit d23441a48e516b6c34aea4fa41551a30e30af803. The setup-python action was removed because Python now runs inside the repository test container.

[zbzbdzb]

The six focused tests and generated-table schema validation passed locally. The new test workflow and compatibility schema workflow currently report completed / action_required, both with zero jobs:

• https://github.com/pluralsh/console/actions/runs/34211460492
• https://github.com/pluralsh/console/actions/runs/34211460180

Could a maintainer check whether these contributor runs need approval? I have not treated that state as a hosted CI pass.