HOSTEDCP-1849: blocked-edges/4.15-HyperShiftKubeAPIPort443: Declare risk

[wking]

Generated by writing the 4.15.17 risk by hand, and then copying it out to the other exposed releases with:

$ curl -s 'https://api.openshift.com/api/upgrades_info/graph?channel=candidate-4.15&arch=amd64' | jq -r '.nodes[] | .version' | grep '^4[.]15[.]\(1[8-9]\|2[0-4]\)$' | while read VERSION; do sed "s/4.15.17/${VERSION}/" blocked-edges/4.15.17-HyperShiftKubeAPIPort443.yaml > "blocked-edges/${VERSION}-HyperShiftKubeAPIPort443.yaml"; done

After which I manually declared fixedIn for 4.15.25, which included OCPBUGS-37695.

I did not need to declare 4.16 risks, because f8316da (2024-06-06, #5352) landed early enough that no exposed 4.16 bake in update-recommendations from unexposed 4.15.(z<17) releases. For example:

$ oc adm release info quay.io/openshift-release-dev/ocp-release:4.16.0-x86_64 | grep 'Created\|Upgrades'
Created:        2024-06-25T20:17:15Z
  Upgrades: 4.15.18, 4.16.0-ec.1, 4.16.0-ec.2, 4.16.0-ec.3, 4.16.0-ec.4, 4.16.0-ec.5, 4.16.0-ec.6, 4.16.0-rc.0, 4.16.0-rc.1, 4.16.0-rc.2, 4.16.0-rc.3, 4.16.0-rc.4, 4.16.0-rc.5, 4.16.0-rc.6, 4.16.0-rc.9

[openshift-ci-robot]

@wking: This pull request references HOSTEDCP-1849 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the spike to target the "4.17.0" version, but no target version was set.

Details

In response to this:

Generated by writing the 4.15.17 and 4.16.0 risks by hand, and then copying them out to the other exposed releases with:

$ curl -s 'https://api.openshift.com/api/upgrades_info/graph?channel=candidate-4.15&arch=amd64' | jq -r '.nodes[] | .version' | grep '^4[.]15[.]\(1[8-9]\|2[0-4]\)$' | while read VERSION; do sed "s/4.15.17/${VERSION}/" blocked-edges/4.15.17-HyperShiftKubeAPIPort433.yaml > "blocked-edges/${VERSION}-HyperShiftKubeAPIPort433.yaml"; done
$ curl -s 'https://api.openshift.com/api/upgrades_info/graph?channel=candidate-4.16&arch=amd64' | jq -r '.nodes[] | .version' | grep '^4[.]16[.][1-5]$' | while read VERSION; do sed "s/4.16.0/${VERSION}/" blocked-edges/4.16.0-HyperShiftKubeAPIPort433.yaml > "blocked-edges/${VERSION}-HyperShiftKubeAPIPort433.yaml"; done

After which I manually declared fixedIn for:

• 4.16.6, which includes OCPBUGS-37645.
• 4.15.25, which includes OCPBUGS-37695.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@wking: This pull request references HOSTEDCP-1849 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the spike to target the "4.17.0" version, but no target version was set.

Details

In response to this:

Generated by writing the 4.15.17 and 4.16.0 risks by hand, and then copying them out to the other exposed releases with:

$ curl -s 'https://api.openshift.com/api/upgrades_info/graph?channel=candidate-4.15&arch=amd64' | jq -r '.nodes[] | .version' | grep '^4[.]15[.]\(1[8-9]\|2[0-4]\)$' | while read VERSION; do sed "s/4.15.17/${VERSION}/" blocked-edges/4.15.17-HyperShiftKubeAPIPort443.yaml > "blocked-edges/${VERSION}-HyperShiftKubeAPIPort443.yaml"; done
$ curl -s 'https://api.openshift.com/api/upgrades_info/graph?channel=candidate-4.16&arch=amd64' | jq -r '.nodes[] | .version' | grep '^4[.]16[.][1-5]$' | while read VERSION; do sed "s/4.16.0/${VERSION}/" blocked-edges/4.16.0-HyperShiftKubeAPIPort443.yaml > "blocked-edges/${VERSION}-HyperShiftKubeAPIPort443.yaml"; done

After which I manually declared fixedIn for:

• 4.16.6, which includes OCPBUGS-37645.
• 4.15.25, which includes OCPBUGS-37695.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[hongkailiu]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hongkailiu, wking

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [wking]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[wking]

/hold I can drop the 4.16s

[openshift-ci]

New changes are detected. LGTM label has been removed.

[openshift-ci-robot]

@wking: This pull request references HOSTEDCP-1849 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the spike to target the "4.17.0" version, but no target version was set.

Details

In response to this:

Generated by writing the 4.15.17 risk by hand, and then copying it out to the other exposed releases with:

$ curl -s 'https://api.openshift.com/api/upgrades_info/graph?channel=candidate-4.15&arch=amd64' | jq -r '.nodes[] | .version' | grep '^4[.]15[.]\(1[8-9]\|2[0-4]\)$' | while read VERSION; do sed "s/4.15.17/${VERSION}/" blocked-edges/4.15.17-HyperShiftKubeAPIPort443.yaml > "blocked-edges/${VERSION}-HyperShiftKubeAPIPort443.yaml"; done

After which I manually declared fixedIn for 4.15.25, which included OCPBUGS-37695.

I did not need to declare 4.16 risks, because f8316da (2024-06-06, #5352) landed early enough that no exposed 4.16 bake in update-recommendations from unexposed 4.15.(z<17) releases. For example:

$ oc adm release info quay.io/openshift-release-dev/ocp-release:4.16.0-x86_64 | grep 'Created\|Upgrades'
Created:        2024-06-25T20:17:15Z
 Upgrades: 4.15.18, 4.16.0-ec.1, 4.16.0-ec.2, 4.16.0-ec.3, 4.16.0-ec.4, 4.16.0-ec.5, 4.16.0-ec.6, 4.16.0-rc.0, 4.16.0-rc.1, 4.16.0-rc.2, 4.16.0-rc.3, 4.16.0-rc.4, 4.16.0-rc.5, 4.16.0-rc.6, 4.16.0-rc.9

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[wking]

Testing the PromQL on a classic/standalone/non-HyperShift cluster (build02), it correctly judges "I'm not exposed to this risk":

[wking]

I'd like to test on a HyperShift cluster too, but Cluster Bot is timing out on getting me one, and the PromQL I'm using is very similar to what we've used on previous risks like TechPreviewSignatureStoresInDefault and NetworkNodeIdentityWebhookUserConflict, so I'm fine with this merging without that being tested.

And before he clocked out, Hongkai LGTMed this. I'm confident in my subsequent removal of the 4.16 risks, so I'm unilaterally restoring the LGTM label to get this landed before the weekend.

/hold cancel