OCPBUGS-54650, OCPBUGS-54651, OCPBUGS-54652: desiredSubscription: Specify annotations and SCC by Miciah · Pull Request #1214 · openshift/cluster-ingress-operator

Miciah · 2025-04-07T16:11:44Z

Specify the "openshift.io/required-scc" and "target.workload.openshift.io/management" annotations and as well as resource requests (but not resource limits) for the subscription in order to comply with OpenShift platform conventions, which require specifying a required SCC and prohibit specifying resource limits for platform components.

Specifying annotations requires bumping the vendored operator-framework API:

go get github.com/operator-framework/api
go mod tidy
go mod vendor

Also, specify the "target.workload.openshift.io/management" annotation for Istiod.

These changes fix OCPBUGS-54650, OCPBUGS-54651, and OCPBUGS-54652.

openshift-ci-robot · 2025-04-07T16:11:50Z

@Miciah: This pull request references Jira Issue OCPBUGS-54650, which is invalid:

expected the bug to target the "4.19.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Specify the "openshift.io/required-scc" annotation and as well as resource requests (but not resource limits) for the subscription in order to comply with OpenShift platform conventions, which require specifying a required SCC and prohibit specifying resource limits for platform components.

Specifying annotations requires bumping the vendored operator-framework API:

go get github.com/operator-framework/api
go mod tidy
go mod vendor

This commit fixes OCPBUGS-54650 and partially fixes OCPBUGS-54651.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2025-04-07T16:14:44Z

@Miciah: This pull request references Jira Issue OCPBUGS-54650, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.19.0) matches configured target version for branch (4.19.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @lihongan

This pull request references Jira Issue OCPBUGS-54651, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.19.0) matches configured target version for branch (4.19.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @lihongan

Details

In response to this:

Specify the "openshift.io/required-scc" annotation and as well as resource requests (but not resource limits) for the subscription in order to comply with OpenShift platform conventions, which require specifying a required SCC and prohibit specifying resource limits for platform components.

Specifying annotations requires bumping the vendored operator-framework API:

go get github.com/operator-framework/api
go mod tidy
go mod vendor

This commit fixes OCPBUGS-54650 and OCPBUGS-54651.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2025-04-07T16:14:50Z

@Miciah: This pull request references Jira Issue OCPBUGS-54650, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.19.0) matches configured target version for branch (4.19.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @lihongan

The bug has been updated to refer to the pull request using the external bug tracker.

This pull request references Jira Issue OCPBUGS-54651, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.19.0) matches configured target version for branch (4.19.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @lihongan

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Specify the "openshift.io/required-scc" annotation and as well as resource requests (but not resource limits) for the subscription in order to comply with OpenShift platform conventions, which require specifying a required SCC and prohibit specifying resource limits for platform components.

Specifying annotations requires bumping the vendored operator-framework API:

go get github.com/operator-framework/api
go mod tidy
go mod vendor

This commit fixes OCPBUGS-54650 and partially fixes OCPBUGS-54651.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Specify the "openshift.io/required-scc" and "target.workload.openshift.io/management" annotations and as well as resource requests (but *not* resource limits) for the subscription in order to comply with OpenShift platform conventions, which require specifying a required SCC and workload partitioning configuration and prohibit specifying resource limits for platform components. Specifying annotations requires bumping the vendored operator-framework API: go get github.com/operator-framework/api go mod tidy go mod vendor This commit fixes OCPBUGS-54650 and OCPBUGS-54651 and partially fixes OCPBUGS-54652. https://issues.redhat.com/browse/OCPBUGS-54650 https://issues.redhat.com/browse/OCPBUGS-54651 https://issues.redhat.com/browse/OCPBUGS-54652 * go.mod: Bump github.com/operator-framework/api to get the Subscription.spec.config.annotations field. * go.sum: * vendor/*: Regenerate. * pkg/operator/controller/gatewayclass/subscription.go (RequiredSCCRestrictedV2): New const for the "restricted-v2" SCC name. (desiredSubscription): Specify resource requests (but not limits) and the "openshift.io/required-scc" and "target.workload.openshift.io/management" annotations.

openshift-ci-robot · 2025-04-07T16:24:13Z

@Miciah: This pull request references Jira Issue OCPBUGS-54650, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.19.0) matches configured target version for branch (4.19.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @lihongan

This pull request references Jira Issue OCPBUGS-54651, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.19.0) matches configured target version for branch (4.19.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @lihongan

Details

In response to this:

Specify the "openshift.io/required-scc" and "target.workload.openshift.io/management" annotations and as well as resource requests (but not resource limits) for the subscription in order to comply with OpenShift platform conventions, which require specifying a required SCC and prohibit specifying resource limits for platform components.

Specifying annotations requires bumping the vendored operator-framework API:

go get github.com/operator-framework/api
go mod tidy
go mod vendor

This change fixes OCPBUGS-54650 and OCPBUGS-54651 and partially fixes OCPBUGS-54652.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Specify the "target.workload.openshift.io/management" annotation for Istiod. This commit, along with the previous, fixes OCPBUGS-54652. https://issues.redhat.com/browse/OCPBUGS-54652 * pkg/operator/controller/gatewayclass/istio.go (desiredIstio): Specify the "target.workload.openshift.io/management" annotation in Istio.spec.values.pilot.podAnnotations.

openshift-ci-robot · 2025-04-07T16:36:38Z

@Miciah: This pull request references Jira Issue OCPBUGS-54650, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.19.0) matches configured target version for branch (4.19.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @lihongan

The bug has been updated to refer to the pull request using the external bug tracker.

This pull request references Jira Issue OCPBUGS-54651, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.19.0) matches configured target version for branch (4.19.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @lihongan

The bug has been updated to refer to the pull request using the external bug tracker.

This pull request references Jira Issue OCPBUGS-54652, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.19.0) matches configured target version for branch (4.19.0)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @lihongan

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Specify the "openshift.io/required-scc" and "target.workload.openshift.io/management" annotations and as well as resource requests (but not resource limits) for the subscription in order to comply with OpenShift platform conventions, which require specifying a required SCC and prohibit specifying resource limits for platform components.

Specifying annotations requires bumping the vendored operator-framework API:

go get github.com/operator-framework/api
go mod tidy
go mod vendor

Also, specify the "target.workload.openshift.io/management" annotation for Istiod.

These changes fix OCPBUGS-54650, OCPBUGS-54651, and OCPBUGS-54652.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

candita · 2025-04-07T20:53:16Z

pkg/operator/controller/gatewayclass/subscription.go

+	RequiredSCCRestrictedV2 = "restricted-v2"
+	// WorkloadPartitioningManagementAnnotationKey is the annotation key for
+	// workload partitioning.
+	WorkloadPartitioningManagementAnnotationKey = "target.workload.openshift.io/management"


We have this defined here too:

cluster-ingress-operator/pkg/operator/controller/ingress/deployment.go

Line 97 in 1410fe0

WorkloadPartitioningManagement = "target.workload.openshift.io/management"

Is there a way to combine these?

I could put it in names.go, or I could define a new file for these consts that really ought to be in some imported package (in this case, probably in openshift/api) but are not.

Miciah · 2025-04-07T21:22:34Z

I'm not seeing the expected results. subscriptions.json from e2e-aws-operator-techpreview has the expected spec.config:

% curl -s 'https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/openshift_cluster-ingress-operator/1214/pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-operator-techpreview/1909286375597805568/artifacts/e2e-aws-operator-techpreview/gather-extra/artifacts/subscriptions.json' | jq '.items.[]|select(.metadata.name=="servicemeshoperator3")|[.spec.config]'                                                                                                                                                                   
[
  {
    "annotations": {
      "openshift.io/required-scc": "restricted-v2",
      "target.workload.openshift.io/management": "{\"effect\": \"PreferredDuringScheduling\"}"
    },
    "resources": {
      "requests": {
        "cpu": "10m",
        "memory": "64Mi"
      }
    }
  }
]
%

However, pods.json still shows the original resource limits and does not show the desired annotations:

% curl -s 'https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/openshift_cluster-ingress-operator/1214/pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-operator-techpreview/1909286375597805568/artifacts/e2e-aws-operator-techpreview/gather-extra/artifacts/pods.json' | jq '.items.[]|select(.metadata.name|startswith("servicemesh"))|[.metadata.name,.metadata.annotations["openshift.io/required-scc"],.metadata.annotations["target.workload.openshift.io/management"],.spec.containers[0].resources]'    
[
  "servicemesh-operator3-6b4fb78799-44rfk",
  null,
  null,
  {
    "limits": {
      "cpu": "500m",
      "memory": "512Mi"
    },
    "requests": {
      "cpu": "10m",
      "memory": "64Mi"
    }
  }
]
%

pods.json is likewise missing the expected annotations for the istiod pod:

% curl -s 'https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/openshift_cluster-ingress-operator/1214/pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-operator-techpreview/1909286375597805568/artifacts/e2e-aws-operator-techpreview/gather-extra/artifacts/pods.json' | jq '.items.[]|select(.metadata.name|startswith("istiod"))|[.metadata.name,.metadata.annotations["openshift.io/required-scc"],.metadata.annotations["target.workload.openshift.io/management"]]' 
[
  "istiod-openshift-gateway-58f4545948-6vjth",
  null,
  null
]
%

subscriptions.json and pods.json from e2e-aws-gatewayapi show the same:

% curl -s 'https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/openshift_cluster-ingress-operator/1214/pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-gatewayapi/1909286365133017088/artifacts/e2e-aws-gatewayapi/gather-extra/artifacts/subscriptions.json' | jq '.items.[]|select(.metadata.name=="servicemeshoperator3")|[.spec.config]'
[
  {
    "annotations": {
      "openshift.io/required-scc": "restricted-v2",
      "target.workload.openshift.io/management": "{\"effect\": \"PreferredDuringScheduling\"}"
    },
    "resources": {
      "requests": {
        "cpu": "10m",
        "memory": "64Mi"
      }
    }
  }
]
% curl -s 'https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/openshift_cluster-ingress-operator/1214/pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-gatewayapi/1909286365133017088/artifacts/e2e-aws-gatewayapi/gather-extra/artifacts/pods.json' | jq '.items.[]|select(.metadata.name|startswith("servicemesh"))|[.metadata.name,.metadata.annotations["openshift.io/required-scc"],.metadata.annotations["target.workload.openshift.io/management"],.spec.containers[0].resources]'
[
  "servicemesh-operator3-6b4fb78799-bxpfg",
  null,
  null,
  {
    "limits": {
      "cpu": "500m",
      "memory": "512Mi"
    },
    "requests": {
      "cpu": "10m",
      "memory": "64Mi"
    }
  }
]
% curl -s 'https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/openshift_cluster-ingress-operator/1214/pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-gatewayapi/1909286365133017088/artifacts/e2e-aws-gatewayapi/gather-extra/artifacts/pods.json' | jq '.items.[]|select(.metadata.name|startswith("istiod"))|[.metadata.name,.metadata.annotations["openshift.io/required-scc"],.metadata.annotations["target.workload.openshift.io/management"]]'    
[
  "istiod-openshift-gateway-58f4545948-5jch7",
  null,
  null
]
%

Miciah · 2025-04-09T01:14:28Z

I'm seeing weird behavior in my own testing. target.workload.openshift.io/management never gets set on servicemesh-opeator3 or istiod, but openshift.io/required-scc does get set on servicemesh-operator3, and the resource limit is removed from servicemesh-operator3. Let's rerun e2e-aws-gatewayapi to see what happens.

/test e2e-aws-gatewayapi

candita · 2025-04-09T15:21:58Z

/assign @alebedev87
/assign

Miciah · 2025-04-09T15:30:49Z

From the last e2e-aws-gatewayapi run—

Good:

% curl -s 'https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/openshift_cluster-ingress-operator/1214/pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-gatewayapi/1909776903103844352/artifacts/e2e-aws-gatewayapi/gather-extra/artifacts/deployments.json' | jq '.items.[]|select(.metadata.name|startswith("istiod")).spec.template.metadata.annotations["target.workload.openshift.io/management"]'   
"{\"effect\": \"PreferredDuringScheduling\"}"
%

Not good:

% curl -s 'https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/openshift_cluster-ingress-operator/1214/pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-gatewayapi/1909776903103844352/artifacts/e2e-aws-gatewayapi/gather-extra/artifacts/deployments.json' | jq '.items.[]|select(.metadata.name == "servicemesh-operator3").spec.template|[.metadata.annotations["target.workload.openshift.io/management"],.metadata.annotations["openshift.io/required-scc"],.spec.containers[0].resources]' 
[
  null,
  null,
  {
    "limits": {
      "cpu": "500m",
      "memory": "512Mi"
    },
    "requests": {
      "cpu": "10m",
      "memory": "64Mi"
    }
  }
]
%

But cluster-ingress-operator specified the correct Subscription.spec.config:

% curl -s 'https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/openshift_cluster-ingress-operator/1214/pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-gatewayapi/1909776903103844352/artifacts/e2e-aws-gatewayapi/gather-extra/artifacts/subscriptions.json' | jq '.items.[]|select(.metadata.name=="servicemeshoperator3").spec.config'
{
  "annotations": {
    "openshift.io/required-scc": "restricted-v2",
    "target.workload.openshift.io/management": "{\"effect\": \"PreferredDuringScheduling\"}"
  },
  "resources": {
    "requests": {
      "cpu": "10m",
      "memory": "64Mi"
    }
  }
}
%

candita · 2025-04-09T15:53:21Z

The results for e2e-aws-ovn-serial only show flakes, not failures. It timed out after 4 hours

/test e2e-aws-ovn-serial

candita · 2025-04-09T15:55:42Z

TestNodePool/HostedCluster failures
/test hypershift-e2e-aks

candita · 2025-04-09T16:01:50Z

/lgtm
/approve

openshift-ci · 2025-04-09T16:03:55Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: candita

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [candita]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Miciah · 2025-04-09T16:44:35Z

/test e2e-aws-ovn-serial

openshift-ci-robot · 2025-04-09T17:52:45Z

/retest-required

Remaining retests: 0 against base HEAD 7dbe2c5 and 2 for PR HEAD 4c5265c in total

Miciah · 2025-04-09T19:45:03Z

In a Cluster Bot cluster launched using this PR (launch openshift/cluster-ingress-operator#1214 aws,techpreview), everything looks fine:

% oc -n openshift-operators get subscriptions/servicemeshoperator3 -o 'jsonpath={.spec.config}{"\n"}'
{"annotations":{"openshift.io/required-scc":"restricted-v2","target.workload.openshift.io/management":"{\"effect\": \"PreferredDuringScheduling\"}"},"resources":{"requests":{"cpu":"10m","memory":"64Mi"}}}
% oc -n openshift-operators get pods -l control-plane=servicemesh-operator3 -o 'jsonpath={.items..spec.containers[0].resources}{"\n"}'
{"requests":{"cpu":"10m","memory":"64Mi"}}
% oc -n openshift-operators get deployments/servicemesh-operator3 -o yaml | grep -e 'target\.workload' -e required-scc                 
    openshift.io/required-scc: restricted-v2
    target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
        openshift.io/required-scc: restricted-v2
        target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
% oc get istios/openshift-gateway -o 'jsonpath={.spec.values.pilot.podAnnotations}{"\n"}'
{"target.workload.openshift.io/management":"{\"effect\": \"PreferredDuringScheduling\"}"}
% oc -n openshift-ingress get deployments/istiod-openshift-gateway -o yaml | grep -e 'target\.workload'                
        target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
%

openshift-ci-robot · 2025-04-09T19:52:21Z

/retest-required

Remaining retests: 0 against base HEAD 9537a3f and 1 for PR HEAD 4c5265c in total

openshift-ci · 2025-04-10T00:49:24Z

@Miciah: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/okd-scos-e2e-aws-ovn	`4c5265c`	link	false	`/test okd-scos-e2e-aws-ovn`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Miciah · 2025-04-10T03:08:53Z

e2e-aws-ovn failed because [sig-olmv1][OCPFeatureGate:NewOLM][Skipped:Disconnected] OLMv1 operator installation should block cluster upgrades if an incompatible operator is installed, [sig-olmv1][OCPFeatureGate:NewOLM][Skipped:Disconnected] OLMv1 operator installation should fail to install a non-existing cluster extension, and [sig-olmv1][OCPFeatureGate:NewOLM][Skipped:Disconnected] OLMv1 operator installation should install a cluster extension failed:

{  fail [github.com/openshift/origin/test/extended/olm/olmv1.go:242]: Expected
    <string>: expected status to be "True": &Condition{Type:Installed,Status:False,ObservedGeneration:1,LastTransitionTime:2025-04-09 22:57:57 +0000 UTC,Reason:Failed,Message:No bundle installed,}
to be empty
Ginkgo exit error 1: exit with code 1}

{  fail [github.com/openshift/origin/test/extended/olm/olmv1.go:216]: Expected
    <string>: expected message to contain "no bundles found": &Condition{Type:Progressing,Status:True,ObservedGeneration:1,LastTransitionTime:2025-04-09 22:57:59 +0000 UTC,Reason:Retrying,Message:error walking catalogs: error getting package "does-not-exist" from catalog "openshift-certified-operators": error retrieving cache for catalog "openshift-certified-operators": error performing request: Get "https://catalogd-service.openshift-catalogd.svc/catalogs/openshift-certified-operators/api/v1/all": tls: failed to verify certificate: x509: certificate signed by unknown authority,}
to be empty
Ginkgo exit error 1: exit with code 1}

{  fail [github.com/openshift/origin/test/extended/olm/olmv1.go:190]: Expected
    <string>: expected status to be "True": &Condition{Type:Installed,Status:False,ObservedGeneration:1,LastTransitionTime:2025-04-09 23:04:08 +0000 UTC,Reason:Failed,Message:No bundle installed,}
to be empty
Ginkgo exit error 1: exit with code 1}

Let's see whether the failures repeat.
/test e2e-aws-ovn

openshift-ci-robot · 2025-04-10T05:32:10Z

@Miciah: Jira Issue OCPBUGS-54650: All pull requests linked via external trackers have merged:

openshift/cluster-ingress-operator#1214

Jira Issue OCPBUGS-54650 has been moved to the MODIFIED state.

Jira Issue OCPBUGS-54651: All pull requests linked via external trackers have merged:

openshift/cluster-ingress-operator#1214

Jira Issue OCPBUGS-54651 has been moved to the MODIFIED state.

Jira Issue OCPBUGS-54652: All pull requests linked via external trackers have merged:

openshift/cluster-ingress-operator#1214

Jira Issue OCPBUGS-54652 has been moved to the MODIFIED state.

Details

In response to this:

Specify the "openshift.io/required-scc" and "target.workload.openshift.io/management" annotations and as well as resource requests (but not resource limits) for the subscription in order to comply with OpenShift platform conventions, which require specifying a required SCC and prohibit specifying resource limits for platform components.

Specifying annotations requires bumping the vendored operator-framework API:

go get github.com/operator-framework/api
go mod tidy
go mod vendor

Also, specify the "target.workload.openshift.io/management" annotation for Istiod.

These changes fix OCPBUGS-54650, OCPBUGS-54651, and OCPBUGS-54652.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-bot · 2025-04-10T09:18:38Z

[ART PR BUILD NOTIFIER]

Distgit: ose-cluster-ingress-operator
This PR has been included in build ose-cluster-ingress-operator-container-v4.19.0-202504100822.p0.g6897ce1.assembly.stream.el9.
All builds following this will include this PR.

openshift-ci-robot added jira/severity-critical Referenced Jira bug's severity is critical for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. labels Apr 7, 2025

openshift-ci-robot added the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Apr 7, 2025

openshift-ci bot requested review from grzpiotrowski and rfredette April 7, 2025 16:12

Miciah changed the title ~~OCPBUGS-54650: desiredSubscription: Specify annotations and SCC~~ OCPBUGS-54650, OCPBUGS-54651: desiredSubscription: Specify annotations and SCC Apr 7, 2025

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Apr 7, 2025

openshift-ci bot requested a review from lihongan April 7, 2025 16:14

Miciah force-pushed the OCPBUGS-54650-desiredSubscription-specify-annotations-and-SCC branch 2 times, most recently from 1b82d96 to dfe9e52 Compare April 7, 2025 16:22

Miciah force-pushed the OCPBUGS-54650-desiredSubscription-specify-annotations-and-SCC branch from dfe9e52 to 58959aa Compare April 7, 2025 16:23

Miciah changed the title ~~OCPBUGS-54650, OCPBUGS-54651: desiredSubscription: Specify annotations and SCC~~ OCPBUGS-54650, OCPBUGS-54651, OCPBUGS-54652: desiredSubscription: Specify annotations and SCC Apr 7, 2025

candita reviewed Apr 7, 2025

View reviewed changes

openshift-ci bot assigned alebedev87 and candita Apr 9, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Apr 9, 2025

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 9, 2025

openshift-merge-bot bot merged commit 6897ce1 into openshift:master Apr 10, 2025
18 of 19 checks passed

Miciah mentioned this pull request Apr 10, 2025

OCPBUGS-54745: status: Conditionally add CRDs to relatedObjects #1217

Merged

openshift-ci-robot mentioned this pull request Apr 23, 2025

OCPBUGS-54651: resources: Add limit exceptions for Istio openshift/origin#29690

Merged

Comments

Conversation

Miciah commented Apr 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Apr 7, 2025

Uh oh!

openshift-ci-robot commented Apr 7, 2025

Uh oh!

openshift-ci-robot commented Apr 7, 2025

Uh oh!

openshift-ci-robot commented Apr 7, 2025

Uh oh!

openshift-ci-robot commented Apr 7, 2025

Uh oh!

candita Apr 7, 2025

Choose a reason for hiding this comment

Uh oh!

Miciah Apr 7, 2025

Choose a reason for hiding this comment

Uh oh!

Miciah commented Apr 7, 2025

Uh oh!

Miciah commented Apr 9, 2025

Uh oh!

candita commented Apr 9, 2025

Uh oh!

Miciah commented Apr 9, 2025

Uh oh!

candita commented Apr 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

candita commented Apr 9, 2025

Uh oh!

candita commented Apr 9, 2025

Uh oh!

openshift-ci bot commented Apr 9, 2025

Uh oh!

Miciah commented Apr 9, 2025

Uh oh!

openshift-ci-robot commented Apr 9, 2025

Uh oh!

Miciah commented Apr 9, 2025

Uh oh!

openshift-ci-robot commented Apr 9, 2025

Uh oh!

openshift-ci bot commented Apr 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Miciah commented Apr 10, 2025

Uh oh!

Uh oh!

openshift-ci-robot commented Apr 10, 2025

Uh oh!

openshift-bot commented Apr 10, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Miciah commented Apr 7, 2025 •

edited

Loading

candita commented Apr 9, 2025 •

edited

Loading

openshift-ci bot commented Apr 10, 2025 •

edited

Loading