From b573872208ce1e9539bde7b261b0a6b3989b788d Mon Sep 17 00:00:00 2001 From: "W. Trevor King" Date: Tue, 27 Jun 2023 10:03:14 -0700 Subject: [PATCH] blocked-edges/4.13.*-PerformanceProfilesCPUQuota: Declare new risk The PromQL approach is similar to what we used in c641333f4a (blocked-edges/4.11.6: declare OVNNetworkPolicyLongName risk, 2022-09-27, #2552), except: * I'm using the PerformanceProfiles resource. * I'm using apiserver_storage_objects instead of cluster:usage:resources:sum, to cut out one lossy layer of indirection [1]. Generated by writing the 4.13.0 declaration by hand, and then copying out to other 4.13 releases with: $ curl -s 'https://api.openshift.com/api/upgrades_info/graph?channel=candidate-4.13' | jq -r '.nodes[].version' | grep '^4[.]13[.]' | grep -v '^4[.]13[.]0$' | while read V; do sed "s/4[.]13[.]0/${V}/g" blocked-edges/4.13.0-PerformanceProfilesCPUQuota.yaml > "blocked-edges/${V}-PerformanceProfilesCPUQuota.yaml"; done $ git add blocked-edges/4.13.*PerformanceProfilesCPUQuota.yaml [1]: https://github.com/openshift/cluster-monitoring-operator/blob/70dd5c9a414448ace1d07090730510d5922b6b18/jsonnet/rules.libsonnet#L291-L292C20 --- .../4.13.0-PerformanceProfilesCPUQuota.yaml | 13 +++++++++++++ .../4.13.0-ec.1-PerformanceProfilesCPUQuota.yaml | 13 +++++++++++++ .../4.13.0-ec.2-PerformanceProfilesCPUQuota.yaml | 13 +++++++++++++ .../4.13.0-ec.3-PerformanceProfilesCPUQuota.yaml | 13 +++++++++++++ .../4.13.0-ec.4-PerformanceProfilesCPUQuota.yaml | 13 +++++++++++++ .../4.13.0-rc.0-PerformanceProfilesCPUQuota.yaml | 13 +++++++++++++ .../4.13.0-rc.2-PerformanceProfilesCPUQuota.yaml | 13 +++++++++++++ .../4.13.0-rc.3-PerformanceProfilesCPUQuota.yaml | 13 +++++++++++++ .../4.13.0-rc.4-PerformanceProfilesCPUQuota.yaml | 13 +++++++++++++ .../4.13.0-rc.5-PerformanceProfilesCPUQuota.yaml | 13 +++++++++++++ .../4.13.0-rc.6-PerformanceProfilesCPUQuota.yaml | 13 +++++++++++++ .../4.13.0-rc.7-PerformanceProfilesCPUQuota.yaml | 13 +++++++++++++ .../4.13.0-rc.8-PerformanceProfilesCPUQuota.yaml | 13 +++++++++++++ .../4.13.1-PerformanceProfilesCPUQuota.yaml | 13 +++++++++++++ .../4.13.2-PerformanceProfilesCPUQuota.yaml | 13 +++++++++++++ .../4.13.3-PerformanceProfilesCPUQuota.yaml | 13 +++++++++++++ .../4.13.4-PerformanceProfilesCPUQuota.yaml | 13 +++++++++++++ 17 files changed, 221 insertions(+) create mode 100644 blocked-edges/4.13.0-PerformanceProfilesCPUQuota.yaml create mode 100644 blocked-edges/4.13.0-ec.1-PerformanceProfilesCPUQuota.yaml create mode 100644 blocked-edges/4.13.0-ec.2-PerformanceProfilesCPUQuota.yaml create mode 100644 blocked-edges/4.13.0-ec.3-PerformanceProfilesCPUQuota.yaml create mode 100644 blocked-edges/4.13.0-ec.4-PerformanceProfilesCPUQuota.yaml create mode 100644 blocked-edges/4.13.0-rc.0-PerformanceProfilesCPUQuota.yaml create mode 100644 blocked-edges/4.13.0-rc.2-PerformanceProfilesCPUQuota.yaml create mode 100644 blocked-edges/4.13.0-rc.3-PerformanceProfilesCPUQuota.yaml create mode 100644 blocked-edges/4.13.0-rc.4-PerformanceProfilesCPUQuota.yaml create mode 100644 blocked-edges/4.13.0-rc.5-PerformanceProfilesCPUQuota.yaml create mode 100644 blocked-edges/4.13.0-rc.6-PerformanceProfilesCPUQuota.yaml create mode 100644 blocked-edges/4.13.0-rc.7-PerformanceProfilesCPUQuota.yaml create mode 100644 blocked-edges/4.13.0-rc.8-PerformanceProfilesCPUQuota.yaml create mode 100644 blocked-edges/4.13.1-PerformanceProfilesCPUQuota.yaml create mode 100644 blocked-edges/4.13.2-PerformanceProfilesCPUQuota.yaml create mode 100644 blocked-edges/4.13.3-PerformanceProfilesCPUQuota.yaml create mode 100644 blocked-edges/4.13.4-PerformanceProfilesCPUQuota.yaml diff --git a/blocked-edges/4.13.0-PerformanceProfilesCPUQuota.yaml b/blocked-edges/4.13.0-PerformanceProfilesCPUQuota.yaml new file mode 100644 index 000000000..b485f5abb --- /dev/null +++ b/blocked-edges/4.13.0-PerformanceProfilesCPUQuota.yaml @@ -0,0 +1,13 @@ +to: 4.13.0 +from: 4[.]12[.].* +url: https://issues.redhat.com/browse/OCPNODE-1705 +name: PerformanceProfilesCPUQuota +message: |- + Pods may not execute properly because of CPU quota issues on clusters using PerformanceProfiles. +matchingRules: +- type: PromQL + promql: + promql: | + group(max_over_time(apiserver_storage_objects{resource="performanceprofiles.performance.openshift.io"}[1h]) > 0) + or + 0 * group(max_over_time(apiserver_storage_objects[1h])) diff --git a/blocked-edges/4.13.0-ec.1-PerformanceProfilesCPUQuota.yaml b/blocked-edges/4.13.0-ec.1-PerformanceProfilesCPUQuota.yaml new file mode 100644 index 000000000..b6e04b435 --- /dev/null +++ b/blocked-edges/4.13.0-ec.1-PerformanceProfilesCPUQuota.yaml @@ -0,0 +1,13 @@ +to: 4.13.0-ec.1 +from: 4[.]12[.].* +url: https://issues.redhat.com/browse/OCPNODE-1705 +name: PerformanceProfilesCPUQuota +message: |- + Pods may not execute properly because of CPU quota issues on clusters using PerformanceProfiles. +matchingRules: +- type: PromQL + promql: + promql: | + group(max_over_time(apiserver_storage_objects{resource="performanceprofiles.performance.openshift.io"}[1h]) > 0) + or + 0 * group(max_over_time(apiserver_storage_objects[1h])) diff --git a/blocked-edges/4.13.0-ec.2-PerformanceProfilesCPUQuota.yaml b/blocked-edges/4.13.0-ec.2-PerformanceProfilesCPUQuota.yaml new file mode 100644 index 000000000..8bab3b5cf --- /dev/null +++ b/blocked-edges/4.13.0-ec.2-PerformanceProfilesCPUQuota.yaml @@ -0,0 +1,13 @@ +to: 4.13.0-ec.2 +from: 4[.]12[.].* +url: https://issues.redhat.com/browse/OCPNODE-1705 +name: PerformanceProfilesCPUQuota +message: |- + Pods may not execute properly because of CPU quota issues on clusters using PerformanceProfiles. +matchingRules: +- type: PromQL + promql: + promql: | + group(max_over_time(apiserver_storage_objects{resource="performanceprofiles.performance.openshift.io"}[1h]) > 0) + or + 0 * group(max_over_time(apiserver_storage_objects[1h])) diff --git a/blocked-edges/4.13.0-ec.3-PerformanceProfilesCPUQuota.yaml b/blocked-edges/4.13.0-ec.3-PerformanceProfilesCPUQuota.yaml new file mode 100644 index 000000000..6ce3ab83e --- /dev/null +++ b/blocked-edges/4.13.0-ec.3-PerformanceProfilesCPUQuota.yaml @@ -0,0 +1,13 @@ +to: 4.13.0-ec.3 +from: 4[.]12[.].* +url: https://issues.redhat.com/browse/OCPNODE-1705 +name: PerformanceProfilesCPUQuota +message: |- + Pods may not execute properly because of CPU quota issues on clusters using PerformanceProfiles. +matchingRules: +- type: PromQL + promql: + promql: | + group(max_over_time(apiserver_storage_objects{resource="performanceprofiles.performance.openshift.io"}[1h]) > 0) + or + 0 * group(max_over_time(apiserver_storage_objects[1h])) diff --git a/blocked-edges/4.13.0-ec.4-PerformanceProfilesCPUQuota.yaml b/blocked-edges/4.13.0-ec.4-PerformanceProfilesCPUQuota.yaml new file mode 100644 index 000000000..c3d10b243 --- /dev/null +++ b/blocked-edges/4.13.0-ec.4-PerformanceProfilesCPUQuota.yaml @@ -0,0 +1,13 @@ +to: 4.13.0-ec.4 +from: 4[.]12[.].* +url: https://issues.redhat.com/browse/OCPNODE-1705 +name: PerformanceProfilesCPUQuota +message: |- + Pods may not execute properly because of CPU quota issues on clusters using PerformanceProfiles. +matchingRules: +- type: PromQL + promql: + promql: | + group(max_over_time(apiserver_storage_objects{resource="performanceprofiles.performance.openshift.io"}[1h]) > 0) + or + 0 * group(max_over_time(apiserver_storage_objects[1h])) diff --git a/blocked-edges/4.13.0-rc.0-PerformanceProfilesCPUQuota.yaml b/blocked-edges/4.13.0-rc.0-PerformanceProfilesCPUQuota.yaml new file mode 100644 index 000000000..0ccbb1da7 --- /dev/null +++ b/blocked-edges/4.13.0-rc.0-PerformanceProfilesCPUQuota.yaml @@ -0,0 +1,13 @@ +to: 4.13.0-rc.0 +from: 4[.]12[.].* +url: https://issues.redhat.com/browse/OCPNODE-1705 +name: PerformanceProfilesCPUQuota +message: |- + Pods may not execute properly because of CPU quota issues on clusters using PerformanceProfiles. +matchingRules: +- type: PromQL + promql: + promql: | + group(max_over_time(apiserver_storage_objects{resource="performanceprofiles.performance.openshift.io"}[1h]) > 0) + or + 0 * group(max_over_time(apiserver_storage_objects[1h])) diff --git a/blocked-edges/4.13.0-rc.2-PerformanceProfilesCPUQuota.yaml b/blocked-edges/4.13.0-rc.2-PerformanceProfilesCPUQuota.yaml new file mode 100644 index 000000000..e2df6fe76 --- /dev/null +++ b/blocked-edges/4.13.0-rc.2-PerformanceProfilesCPUQuota.yaml @@ -0,0 +1,13 @@ +to: 4.13.0-rc.2 +from: 4[.]12[.].* +url: https://issues.redhat.com/browse/OCPNODE-1705 +name: PerformanceProfilesCPUQuota +message: |- + Pods may not execute properly because of CPU quota issues on clusters using PerformanceProfiles. +matchingRules: +- type: PromQL + promql: + promql: | + group(max_over_time(apiserver_storage_objects{resource="performanceprofiles.performance.openshift.io"}[1h]) > 0) + or + 0 * group(max_over_time(apiserver_storage_objects[1h])) diff --git a/blocked-edges/4.13.0-rc.3-PerformanceProfilesCPUQuota.yaml b/blocked-edges/4.13.0-rc.3-PerformanceProfilesCPUQuota.yaml new file mode 100644 index 000000000..685f8f1d8 --- /dev/null +++ b/blocked-edges/4.13.0-rc.3-PerformanceProfilesCPUQuota.yaml @@ -0,0 +1,13 @@ +to: 4.13.0-rc.3 +from: 4[.]12[.].* +url: https://issues.redhat.com/browse/OCPNODE-1705 +name: PerformanceProfilesCPUQuota +message: |- + Pods may not execute properly because of CPU quota issues on clusters using PerformanceProfiles. +matchingRules: +- type: PromQL + promql: + promql: | + group(max_over_time(apiserver_storage_objects{resource="performanceprofiles.performance.openshift.io"}[1h]) > 0) + or + 0 * group(max_over_time(apiserver_storage_objects[1h])) diff --git a/blocked-edges/4.13.0-rc.4-PerformanceProfilesCPUQuota.yaml b/blocked-edges/4.13.0-rc.4-PerformanceProfilesCPUQuota.yaml new file mode 100644 index 000000000..8020ec090 --- /dev/null +++ b/blocked-edges/4.13.0-rc.4-PerformanceProfilesCPUQuota.yaml @@ -0,0 +1,13 @@ +to: 4.13.0-rc.4 +from: 4[.]12[.].* +url: https://issues.redhat.com/browse/OCPNODE-1705 +name: PerformanceProfilesCPUQuota +message: |- + Pods may not execute properly because of CPU quota issues on clusters using PerformanceProfiles. +matchingRules: +- type: PromQL + promql: + promql: | + group(max_over_time(apiserver_storage_objects{resource="performanceprofiles.performance.openshift.io"}[1h]) > 0) + or + 0 * group(max_over_time(apiserver_storage_objects[1h])) diff --git a/blocked-edges/4.13.0-rc.5-PerformanceProfilesCPUQuota.yaml b/blocked-edges/4.13.0-rc.5-PerformanceProfilesCPUQuota.yaml new file mode 100644 index 000000000..edb59c2a7 --- /dev/null +++ b/blocked-edges/4.13.0-rc.5-PerformanceProfilesCPUQuota.yaml @@ -0,0 +1,13 @@ +to: 4.13.0-rc.5 +from: 4[.]12[.].* +url: https://issues.redhat.com/browse/OCPNODE-1705 +name: PerformanceProfilesCPUQuota +message: |- + Pods may not execute properly because of CPU quota issues on clusters using PerformanceProfiles. +matchingRules: +- type: PromQL + promql: + promql: | + group(max_over_time(apiserver_storage_objects{resource="performanceprofiles.performance.openshift.io"}[1h]) > 0) + or + 0 * group(max_over_time(apiserver_storage_objects[1h])) diff --git a/blocked-edges/4.13.0-rc.6-PerformanceProfilesCPUQuota.yaml b/blocked-edges/4.13.0-rc.6-PerformanceProfilesCPUQuota.yaml new file mode 100644 index 000000000..9f1f61f54 --- /dev/null +++ b/blocked-edges/4.13.0-rc.6-PerformanceProfilesCPUQuota.yaml @@ -0,0 +1,13 @@ +to: 4.13.0-rc.6 +from: 4[.]12[.].* +url: https://issues.redhat.com/browse/OCPNODE-1705 +name: PerformanceProfilesCPUQuota +message: |- + Pods may not execute properly because of CPU quota issues on clusters using PerformanceProfiles. +matchingRules: +- type: PromQL + promql: + promql: | + group(max_over_time(apiserver_storage_objects{resource="performanceprofiles.performance.openshift.io"}[1h]) > 0) + or + 0 * group(max_over_time(apiserver_storage_objects[1h])) diff --git a/blocked-edges/4.13.0-rc.7-PerformanceProfilesCPUQuota.yaml b/blocked-edges/4.13.0-rc.7-PerformanceProfilesCPUQuota.yaml new file mode 100644 index 000000000..8efe8b03b --- /dev/null +++ b/blocked-edges/4.13.0-rc.7-PerformanceProfilesCPUQuota.yaml @@ -0,0 +1,13 @@ +to: 4.13.0-rc.7 +from: 4[.]12[.].* +url: https://issues.redhat.com/browse/OCPNODE-1705 +name: PerformanceProfilesCPUQuota +message: |- + Pods may not execute properly because of CPU quota issues on clusters using PerformanceProfiles. +matchingRules: +- type: PromQL + promql: + promql: | + group(max_over_time(apiserver_storage_objects{resource="performanceprofiles.performance.openshift.io"}[1h]) > 0) + or + 0 * group(max_over_time(apiserver_storage_objects[1h])) diff --git a/blocked-edges/4.13.0-rc.8-PerformanceProfilesCPUQuota.yaml b/blocked-edges/4.13.0-rc.8-PerformanceProfilesCPUQuota.yaml new file mode 100644 index 000000000..2272c6358 --- /dev/null +++ b/blocked-edges/4.13.0-rc.8-PerformanceProfilesCPUQuota.yaml @@ -0,0 +1,13 @@ +to: 4.13.0-rc.8 +from: 4[.]12[.].* +url: https://issues.redhat.com/browse/OCPNODE-1705 +name: PerformanceProfilesCPUQuota +message: |- + Pods may not execute properly because of CPU quota issues on clusters using PerformanceProfiles. +matchingRules: +- type: PromQL + promql: + promql: | + group(max_over_time(apiserver_storage_objects{resource="performanceprofiles.performance.openshift.io"}[1h]) > 0) + or + 0 * group(max_over_time(apiserver_storage_objects[1h])) diff --git a/blocked-edges/4.13.1-PerformanceProfilesCPUQuota.yaml b/blocked-edges/4.13.1-PerformanceProfilesCPUQuota.yaml new file mode 100644 index 000000000..86af6ef40 --- /dev/null +++ b/blocked-edges/4.13.1-PerformanceProfilesCPUQuota.yaml @@ -0,0 +1,13 @@ +to: 4.13.1 +from: 4[.]12[.].* +url: https://issues.redhat.com/browse/OCPNODE-1705 +name: PerformanceProfilesCPUQuota +message: |- + Pods may not execute properly because of CPU quota issues on clusters using PerformanceProfiles. +matchingRules: +- type: PromQL + promql: + promql: | + group(max_over_time(apiserver_storage_objects{resource="performanceprofiles.performance.openshift.io"}[1h]) > 0) + or + 0 * group(max_over_time(apiserver_storage_objects[1h])) diff --git a/blocked-edges/4.13.2-PerformanceProfilesCPUQuota.yaml b/blocked-edges/4.13.2-PerformanceProfilesCPUQuota.yaml new file mode 100644 index 000000000..19eb767e4 --- /dev/null +++ b/blocked-edges/4.13.2-PerformanceProfilesCPUQuota.yaml @@ -0,0 +1,13 @@ +to: 4.13.2 +from: 4[.]12[.].* +url: https://issues.redhat.com/browse/OCPNODE-1705 +name: PerformanceProfilesCPUQuota +message: |- + Pods may not execute properly because of CPU quota issues on clusters using PerformanceProfiles. +matchingRules: +- type: PromQL + promql: + promql: | + group(max_over_time(apiserver_storage_objects{resource="performanceprofiles.performance.openshift.io"}[1h]) > 0) + or + 0 * group(max_over_time(apiserver_storage_objects[1h])) diff --git a/blocked-edges/4.13.3-PerformanceProfilesCPUQuota.yaml b/blocked-edges/4.13.3-PerformanceProfilesCPUQuota.yaml new file mode 100644 index 000000000..2534e165a --- /dev/null +++ b/blocked-edges/4.13.3-PerformanceProfilesCPUQuota.yaml @@ -0,0 +1,13 @@ +to: 4.13.3 +from: 4[.]12[.].* +url: https://issues.redhat.com/browse/OCPNODE-1705 +name: PerformanceProfilesCPUQuota +message: |- + Pods may not execute properly because of CPU quota issues on clusters using PerformanceProfiles. +matchingRules: +- type: PromQL + promql: + promql: | + group(max_over_time(apiserver_storage_objects{resource="performanceprofiles.performance.openshift.io"}[1h]) > 0) + or + 0 * group(max_over_time(apiserver_storage_objects[1h])) diff --git a/blocked-edges/4.13.4-PerformanceProfilesCPUQuota.yaml b/blocked-edges/4.13.4-PerformanceProfilesCPUQuota.yaml new file mode 100644 index 000000000..71a561145 --- /dev/null +++ b/blocked-edges/4.13.4-PerformanceProfilesCPUQuota.yaml @@ -0,0 +1,13 @@ +to: 4.13.4 +from: 4[.]12[.].* +url: https://issues.redhat.com/browse/OCPNODE-1705 +name: PerformanceProfilesCPUQuota +message: |- + Pods may not execute properly because of CPU quota issues on clusters using PerformanceProfiles. +matchingRules: +- type: PromQL + promql: + promql: | + group(max_over_time(apiserver_storage_objects{resource="performanceprofiles.performance.openshift.io"}[1h]) > 0) + or + 0 * group(max_over_time(apiserver_storage_objects[1h]))