[release-4.15] OCPBUGS-36466: Allow operator to update Route spec.subdomain #1100

Miciah · 2024-07-03T00:08:05Z

Allow operator to update Route `spec.subdomain`

Before this change, cluster-ingress-operator did not have permission to update spec.host or spec.subdomain on an existing route as the operator's serviceaccount did not have the necessary "routes/custom-host" permission. #965 added logic to the operator to clear spec.host and instead set spec.subdomain, but without the required permission, the update would fail with the following error message:

ERROR   operator.init   controller/controller.go:265    Reconciler error {"controller": "canary_controller", "object": {"name":"default","namespace":"openshift-ingress-operator"}, "namespace": "openshift-ingress-operator", "name": "default", "reconcileID": "463061e3-93a1-4067-802e-03e3f1f8cdd0", "error": "failed to ensure canary route: failed to update canary route openshift-ingress-canary/canary: Route.route.openshift.io \"canary\" is invalid: spec.subdomain: Invalid value: \"canary-openshift-ingress-canary\": field is immutable"}

This PR adds the needed permission to the clusterrole for the operator's serviceaccount so that the update can succeed.

Delete and recreate canary route to clear `spec.host`

Fix the update logic for the canary route to handle clearing spec.host. Attempts to clear spec.host using a simple update may be ignored (see openshift/origin@54c072c). Therefore it is necessary to delete and recreate the route.

Before this change, the operator would set spec.subdomain, but it did not actually clear spec.host, and so setting spec.subdomain had no effect.

After this change, the operator should clear spec.host, and spec.subdomain should be in effect.

This is manual cherry-pick of #1047 and #1099.

openshift-ci-robot · 2024-07-03T00:08:11Z

@Miciah: This pull request references Jira Issue OCPBUGS-36466, which is invalid:

expected dependent Jira Issue OCPBUGS-32887 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is ASSIGNED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Allow operator to update Route spec.subdomain

Before this change, cluster-ingress-operator did not have permission to update spec.host or spec.subdomain on an existing route as the operator's serviceaccount did not have the necessary "routes/custom-host" permission. #965 added logic to the operator to clear spec.host and instead set spec.subdomain, but without the required permission, the update would fail with the following error message:

ERROR operator.init controller/controller.go:265 Reconciler error {"controller": "canary_controller", "object": {"name":"default","namespace":"openshift-ingress-operator"}, "namespace": "openshift-ingress-operator", "name": "default", "reconcileID": "463061e3-93a1-4067-802e-03e3f1f8cdd0", "error": "failed to ensure canary route: failed to update canary route openshift-ingress-canary/canary: Route.route.openshift.io "canary" is invalid: spec.subdomain: Invalid value: "canary-openshift-ingress-canary": field is immutable"}

This PR adds the needed permission to the clusterrole for the operator's serviceaccount so that the update can succeed.

Delete and recreate canary route to clear spec.host

Fix the update logic for the canary route to handle clearing spec.host. Attempts to clear spec.host using a simple update may be ignored (see openshift/origin@54c072c). Therefore it is necessary to delete and recreate the route.

Before this change, the operator would set spec.subdomain, but it did not actually clear spec.host, and so setting spec.subdomain had no effect.

After this change, the operator should clear spec.host, and spec.subdomain should be in effect.

This is manual cherry-pick of #1047 and #1099.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Before this commit, cluster-ingress-operator did not have permission to update spec.host or spec.subdomain on an existing route as the operator's serviceaccount did not have the necessary "routes/custom-host" permission. A previous change to the operator had added logic to clear spec.host and instead set spec.subdomain, but without the required permission, the update would fail with the following error message: ERROR operator.init controller/controller.go:265 Reconciler error {"controller": "canary_controller", "object": {"name":"default","namespace":"openshift-ingress-operator"}, "namespace": "openshift-ingress-operator", "name": "default", "reconcileID": "463061e3-93a1-4067-802e-03e3f1f8cdd0", "error": "failed to ensure canary route: failed to update canary route openshift-ingress-canary/canary: Route.route.openshift.io \"canary\" is invalid: spec.subdomain: Invalid value: \"canary-openshift-ingress-canary\": field is immutable"} This commit adds the needed permission to the clusterrole for the operator's serviceaccount so that the update can succeed. This commit fixes OCPBUGS-32887. https://issues.redhat.com/browse/OCPBUGS-32887 Follow-up to commit 530d326. * manifests/00-cluster-role.yaml: Add permission for routes/custom-host.

Fix the update logic for the canary route to handle clearing spec.host. Attempts to clear spec.host using a simple update may be ignored[1]. Therefore it is necessary to delete and recreate the route. 1. openshift/origin@54c072c Before this commit, the operator would set spec.subdomain, but it did not actually clear spec.host, and so setting spec.subdomain had no effect. After this commit, the operator should clear spec.host, and spec.subdomain should be in effect. Follow-up to commit 77c61ba. This commit is related to OCPBUGS-36465. https://issues.redhat.com/browse/OCPBUGS-36465 * pkg/operator/controller/canary/route.go (updateCanaryRoute): Delete and recreate the route in order to clear spec.host. (deleteCanaryRoute): Add an options parameter for updateCanaryRoute to use. * test/e2e/canary_test.go (TestCanaryRouteClearsSpecHost): New test. Verify that the operator clears spec.host if it is set on the canary route. * test/e2e/all_test.go (TestAll): Add TestCanaryRouteClearsSpecHost as a serial test.

Miciah · 2024-07-03T00:24:16Z

https://github.com/openshift/cluster-ingress-operator/compare/d19536ff9fb53fc72fb6f362e81567eabf45fb9d..357c1a7942e5a194687febab169cce3624f35ddc adds a missing fmt import.

melvinjoseph86 · 2024-07-03T04:57:05Z

/test e2e-gcp-operator

candita · 2024-07-03T15:36:22Z

/assign

melvinjoseph86 · 2024-07-06T17:15:37Z

Verified the fix using clusterbot

create a build using this PR and upgrade a 4.13 cluster using that build.
Didn't see any error messages in the ingress operator logs.

hence marking the bug are verified
/label qe-approved

openshift-ci-robot · 2024-07-06T17:15:43Z

@Miciah: This pull request references Jira Issue OCPBUGS-36466, which is invalid:

expected dependent Jira Issue OCPBUGS-32887 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is POST instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

Allow operator to update Route spec.subdomain

Before this change, cluster-ingress-operator did not have permission to update spec.host or spec.subdomain on an existing route as the operator's serviceaccount did not have the necessary "routes/custom-host" permission. #965 added logic to the operator to clear spec.host and instead set spec.subdomain, but without the required permission, the update would fail with the following error message:

ERROR operator.init controller/controller.go:265 Reconciler error {"controller": "canary_controller", "object": {"name":"default","namespace":"openshift-ingress-operator"}, "namespace": "openshift-ingress-operator", "name": "default", "reconcileID": "463061e3-93a1-4067-802e-03e3f1f8cdd0", "error": "failed to ensure canary route: failed to update canary route openshift-ingress-canary/canary: Route.route.openshift.io "canary" is invalid: spec.subdomain: Invalid value: "canary-openshift-ingress-canary": field is immutable"}

This PR adds the needed permission to the clusterrole for the operator's serviceaccount so that the update can succeed.

Delete and recreate canary route to clear spec.host

Fix the update logic for the canary route to handle clearing spec.host. Attempts to clear spec.host using a simple update may be ignored (see openshift/origin@54c072c). Therefore it is necessary to delete and recreate the route.

Before this change, the operator would set spec.subdomain, but it did not actually clear spec.host, and so setting spec.subdomain had no effect.

After this change, the operator should clear spec.host, and spec.subdomain should be in effect.

This is manual cherry-pick of #1047 and #1099.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

candita · 2024-07-10T21:06:28Z

Dependency on #1099

candita · 2024-07-10T22:49:40Z

Backport is required because the original bug OCPBUGS-36465 was found in version 4.14 and disrupts upgrades from 4.13 to 4.14. Any risk introduced by this fix is balanced against the improvement in the success of 4.14 upgrades.

/label backport-risk-assessed

melvinjoseph86 · 2024-07-11T04:04:17Z

/label cherry-pick-approved

candita · 2024-07-12T18:13:16Z

/approve
/lgtm
/jira refresh

openshift-ci-robot · 2024-07-12T18:13:20Z

@candita: This pull request references Jira Issue OCPBUGS-36466, which is invalid:

expected dependent Jira Issue OCPBUGS-32887 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is ON_QA instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/approve
/lgtm
/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2024-07-12T18:18:58Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: candita

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [candita]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

melvinjoseph86 · 2024-07-13T09:59:50Z

/jira refresh

openshift-ci-robot · 2024-07-13T09:59:55Z

@melvinjoseph86: This pull request references Jira Issue OCPBUGS-36466, which is valid.

7 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.15.z) matches configured target version for branch (4.15.z)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
release note text is set and does not match the template
dependent bug Jira Issue OCPBUGS-32887 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
dependent Jira Issue OCPBUGS-32887 targets the "4.16.z" version, which is one of the valid target versions: 4.16.0, 4.16.z
bug has dependents

Requesting review from QA contact:
/cc @melvinjoseph86

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2024-07-13T12:51:56Z

@Miciah: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot · 2024-07-13T12:54:41Z

@Miciah: Jira Issue OCPBUGS-36466: All pull requests linked via external trackers have merged:

openshift/cluster-ingress-operator#1100

Jira Issue OCPBUGS-36466 has been moved to the MODIFIED state.

Details

In response to this:

Allow operator to update Route spec.subdomain

Before this change, cluster-ingress-operator did not have permission to update spec.host or spec.subdomain on an existing route as the operator's serviceaccount did not have the necessary "routes/custom-host" permission. #965 added logic to the operator to clear spec.host and instead set spec.subdomain, but without the required permission, the update would fail with the following error message:

ERROR operator.init controller/controller.go:265 Reconciler error {"controller": "canary_controller", "object": {"name":"default","namespace":"openshift-ingress-operator"}, "namespace": "openshift-ingress-operator", "name": "default", "reconcileID": "463061e3-93a1-4067-802e-03e3f1f8cdd0", "error": "failed to ensure canary route: failed to update canary route openshift-ingress-canary/canary: Route.route.openshift.io "canary" is invalid: spec.subdomain: Invalid value: "canary-openshift-ingress-canary": field is immutable"}

This PR adds the needed permission to the clusterrole for the operator's serviceaccount so that the update can succeed.

Delete and recreate canary route to clear spec.host

Fix the update logic for the canary route to handle clearing spec.host. Attempts to clear spec.host using a simple update may be ignored (see openshift/origin@54c072c). Therefore it is necessary to delete and recreate the route.

Before this change, the operator would set spec.subdomain, but it did not actually clear spec.host, and so setting spec.subdomain had no effect.

After this change, the operator should clear spec.host, and spec.subdomain should be in effect.

This is manual cherry-pick of #1047 and #1099.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-bot · 2024-07-13T14:35:19Z

[ART PR BUILD NOTIFIER]

This PR has been included in build ose-cluster-ingress-operator-container-v4.15.0-202407131406.p0.g0928822.assembly.stream.el9 for distgit ose-cluster-ingress-operator.
All builds following this will include this PR.

openshift-merge-robot · 2024-07-14T03:20:14Z

Fix included in accepted release 4.15.0-0.nightly-2024-07-13-204028

candita · 2024-07-15T14:45:03Z

/jira refresh

openshift-ci-robot · 2024-07-15T14:45:07Z

@candita: Jira Issue OCPBUGS-36466 is in an unrecognized state (Verified) and will not be moved to the MODIFIED state.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot added jira/severity-moderate Referenced Jira bug's severity is moderate for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. labels Jul 3, 2024

openshift-ci-robot added the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Jul 3, 2024

openshift-ci bot requested review from alebedev87 and candita July 3, 2024 00:08

Miciah mentioned this pull request Jul 3, 2024

[release-4.14] OCPBUGS-36467: Allow operator to update Route spec.subdomain #1101

Merged

Miciah added 2 commits July 2, 2024 20:23

Miciah force-pushed the cherry-pick-1047-and-1099-to-release-4.15 branch from d19536f to 357c1a7 Compare July 3, 2024 00:23

openshift-ci bot assigned candita Jul 3, 2024

openshift-ci bot added the qe-approved Signifies that QE has signed off on this PR label Jul 6, 2024

openshift-ci bot added the backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. label Jul 10, 2024

openshift-ci bot assigned lihongan, melvinjoseph86 and ShudiLi Jul 10, 2024

openshift-ci bot added the cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. label Jul 11, 2024

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jul 12, 2024

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 12, 2024

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jul 13, 2024

openshift-ci bot requested a review from melvinjoseph86 July 13, 2024 09:59

openshift-merge-bot bot merged commit 0928822 into openshift:release-4.15 Jul 13, 2024

[release-4.15] OCPBUGS-36466: Allow operator to update Route spec.subdomain #1100

[release-4.15] OCPBUGS-36466: Allow operator to update Route spec.subdomain #1100

Uh oh!

Conversation

Miciah commented Jul 3, 2024

Allow operator to update Route spec.subdomain

Delete and recreate canary route to clear spec.host

Uh oh!

openshift-ci-robot commented Jul 3, 2024

Allow operator to update Route spec.subdomain

Delete and recreate canary route to clear spec.host

Uh oh!

Miciah commented Jul 3, 2024

Uh oh!

melvinjoseph86 commented Jul 3, 2024

Uh oh!

candita commented Jul 3, 2024

Uh oh!

melvinjoseph86 commented Jul 6, 2024

Uh oh!

openshift-ci-robot commented Jul 6, 2024

Allow operator to update Route spec.subdomain

Delete and recreate canary route to clear spec.host

Uh oh!

candita commented Jul 10, 2024

Uh oh!

candita commented Jul 10, 2024

Uh oh!

melvinjoseph86 commented Jul 11, 2024

Uh oh!

candita commented Jul 12, 2024

Uh oh!

openshift-ci-robot commented Jul 12, 2024

Uh oh!

openshift-ci bot commented Jul 12, 2024

Uh oh!

melvinjoseph86 commented Jul 13, 2024

Uh oh!

openshift-ci-robot commented Jul 13, 2024

Uh oh!

openshift-ci bot commented Jul 13, 2024

Uh oh!

openshift-ci-robot commented Jul 13, 2024

Allow operator to update Route spec.subdomain

Delete and recreate canary route to clear spec.host

Uh oh!

openshift-bot commented Jul 13, 2024

Uh oh!

openshift-merge-robot commented Jul 14, 2024

Uh oh!

candita commented Jul 15, 2024

Uh oh!

openshift-ci-robot commented Jul 15, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Allow operator to update Route `spec.subdomain`

Delete and recreate canary route to clear `spec.host`

Allow operator to update Route `spec.subdomain`

Delete and recreate canary route to clear `spec.host`

Allow operator to update Route `spec.subdomain`

Delete and recreate canary route to clear `spec.host`

Allow operator to update Route `spec.subdomain`

Delete and recreate canary route to clear `spec.host`