[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: df-build-team
Once this PR has been reviewed and has the lgtm label, please assign malayparida2000 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

@df-build-team: This pull request references [Jira Issue DFBUGS-8415](https://redhat.atlassian.net/browse/DFBUGS-8415), which is invalid:

• expected the vulnerability to target the "odf-4.21.9" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

@nik-redhat Similar to 4.20 here also only toolchain is getting updated, whereas we would want the actual version to be updated

@nik-redhat Similar to 4.20 here also only toolchain is getting updated, whereas we would want the actual version to be updated

It's expected to have toolchain updated only since the toolchain directive is mentioned.
Why would you want to update the actual version specifically?

@nik-redhat Similar to 4.20 here also only toolchain is getting updated, whereas we would want the actual version to be updated

It's expected to have toolchain updated only since the toolchain directive is mentioned. Why would you want to update the actual version specifically?

For clarity/consistency basically. For other relases we are bumping the go versions too. So better to bump the go version on 4.20 & 4.21 as well to latest availble builder versions if there are no harm

@nik-redhat Similar to 4.20 here also only toolchain is getting updated, whereas we would want the actual version to be updated

It's expected to have toolchain updated only since the toolchain directive is mentioned. Why would you want to update the actual version specifically?

For clarity/consistency basically. For other relases we are bumping the go versions too. So better to bump the go version on 4.20 & 4.21 as well to latest availble builder versions if there are no harm

Toolchain is basically the maximum allowed go version in the code, so if we bump the toolchain version it keeps the code at the toolchain version which includes the fix of any affected CVE.
Also, it is best to use toolchain wherever applicable.
And, if ocs-operator needs to avoid toolchain update then please don't add toolchain directive in the code at the first place, I think the reason toolchain was added to keep the flexibility in go versions and now when the toolchain is updated to align with the flexibility the ask is to update the go version directly which contradicts the initial goal of having toolchain.

@nik-redhat Similar to 4.20 here also only toolchain is getting updated, whereas we would want the actual version to be updated

It's expected to have toolchain updated only since the toolchain directive is mentioned. Why would you want to update the actual version specifically?

For clarity/consistency basically. For other relases we are bumping the go versions too. So better to bump the go version on 4.20 & 4.21 as well to latest availble builder versions if there are no harm

Toolchain is basically the maximum allowed go version in the code, so if we bump the toolchain version it keeps the code at the toolchain version which includes the fix of any affected CVE. Also, it is best to use toolchain wherever applicable. And, if ocs-operator needs to avoid toolchain update then please don't add toolchain directive in the code at the first place, I think the reason toolchain was added to keep the flexibility in go versions and now when the toolchain is updated to align with the flexibility the ask is to update the go version directly which contradicts the initial goal of having toolchain.

Ack, let's stick to toolchain updated then if it's better

/retest