Bug 2071139: delete default ingress pod if it is scheduled where another router pod already is

go.mod

@@ -16,8 +16,8 @@ require (
 	github.com/go-logr/zapr v1.2.0
 	github.com/google/go-cmp v0.5.6
 	github.com/kevinburke/go-bindata v3.11.0+incompatible
-	github.com/openshift/api v0.0.0-20220121101128-0a830aea20c2
-	github.com/openshift/library-go v0.0.0-20210331235027-66936e2fcc52
+	github.com/openshift/api v0.0.0-20220315184754-d7c10d0b647e
+	github.com/openshift/library-go v0.0.0-20220401140922-0716d0ba0657
 	github.com/pkg/errors v0.9.1
 	github.com/prometheus/client_golang v1.11.0
 	github.com/spf13/cobra v1.2.1
@@ -86,6 +86,7 @@ require (
 	github.com/prometheus/client_model v0.2.0 // indirect
 	github.com/prometheus/common v0.28.0 // indirect
 	github.com/prometheus/procfs v0.6.0 // indirect
+	github.com/robfig/cron v1.2.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	go.mongodb.org/mongo-driver v1.5.1 // indirect
 	go.opencensus.io v0.23.0 // indirect
@@ -112,9 +113,10 @@ require (
 	k8s.io/apiextensions-apiserver v0.23.0 // indirect
 	k8s.io/component-base v0.23.0 // indirect
 	k8s.io/klog/v2 v2.30.0 // indirect
-	k8s.io/kube-aggregator v0.21.0-rc.0 // indirect
+	k8s.io/kube-aggregator v0.23.0 // indirect
 	k8s.io/kube-openapi v0.0.0-20211115234752-e816edb12b65 // indirect
 	sigs.k8s.io/json v0.0.0-20211020170558-c049b76a60c6 // indirect
+	sigs.k8s.io/kube-storage-version-migrator v0.0.4 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.2.0 // indirect
 	sigs.k8s.io/yaml v1.3.0 // indirect
 )

pkg/operator/controller/configurable-route/controller.go

@@ -336,7 +336,7 @@ func (r *reconciler) ensureServiceCertKeyPairSecretRole(componentRoute aggregate
 	} else {
 		role.Name = roleList.Items[0].Name
 		role.GenerateName = ""
-		if _, _, err := resourceapply.ApplyRole(r.kclient.RbacV1(), r.eventRecorder, role); err != nil {
+		if _, _, err := resourceapply.ApplyRole(context.TODO(), r.kclient.RbacV1(), r.eventRecorder, role); err != nil {
 			return "", err
 		}
 	}
@@ -372,6 +372,6 @@ func (r *reconciler) ensureServiceCertKeyPairSecretRoleBinding(role *rbacv1.Role
 		},
 	}
 
-	_, _, err := resourceapply.ApplyRoleBinding(r.kclient.RbacV1(), r.eventRecorder, roleBinding)
+	_, _, err := resourceapply.ApplyRoleBinding(context.TODO(), r.kclient.RbacV1(), r.eventRecorder, roleBinding)
 	return err
 }

pkg/operator/operator.go

@@ -3,9 +3,16 @@ package operator
 import (
 	"context"
 	"fmt"
-	errorpageconfigmapcontroller "github.com/openshift/cluster-ingress-operator/pkg/operator/controller/sync-http-error-code-configmap"
 	"time"
 
+	"github.com/openshift/library-go/pkg/operator/v1helpers"
+
+	errorpageconfigmapcontroller "github.com/openshift/cluster-ingress-operator/pkg/operator/controller/sync-http-error-code-configmap"
+	"github.com/openshift/library-go/pkg/operator/onepodpernodeccontroller"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/client-go/informers"
+	"k8s.io/client-go/kubernetes"
+
 	configv1 "github.com/openshift/api/config/v1"
 	operatorv1 "github.com/openshift/api/operator/v1"
 	logf "github.com/openshift/cluster-ingress-operator/pkg/log"
@@ -97,6 +104,33 @@ func New(config operatorconfig.Config, kubeConfig *rest.Config) (*Operator, erro
 		return nil, fmt.Errorf("failed to create ingress controller: %v", err)
 	}
 
+	kubeClient, err := kubernetes.NewForConfig(kubeConfig)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create kube client: %w", err)
+	}
+	namespaceInformers := informers.NewSharedInformerFactoryWithOptions(kubeClient, 24*time.Hour, informers.WithNamespace(operatorcontroller.DefaultOperandNamespace))
+	// this only handles the case for the default router which is used for oauth-server, console, and other
+	// platform services.  The scheduler bug will need to be fixed to correct the rest.
+	// Once https://bugzilla.redhat.com/show_bug.cgi?id=2062459 is fixed, this controller can be removed.
+	forcePodSpread := onepodpernodeccontroller.NewOnePodPerNodeController(
+		"spread-default-router-pods",
+		operatorcontroller.DefaultOperandNamespace,
+		operatorcontroller.IngressControllerDeploymentPodSelector(&operatorv1.IngressController{ObjectMeta: metav1.ObjectMeta{Name: "default"}}),
+		30, // minReadySeconds from deployments.apps/router-default
+		events.NewKubeRecorder(kubeClient.CoreV1().Events(config.Namespace), "cluster-ingress-operator", &corev1.ObjectReference{
+			APIVersion: "apps/v1",
+			Kind:       "Deployment",
+			Namespace:  config.Namespace,
+			Name:       "ingress-operator",
+		}),
+		// ingress operator appears to be wired to a namespaced resource
+		v1helpers.NewFakeOperatorClient(&operatorv1.OperatorSpec{ManagementState: operatorv1.Managed}, &operatorv1.OperatorStatus{}, nil),
+		kubeClient,
+		namespaceInformers.Core().V1().Pods(),
+	)
+	go forcePodSpread.Run(context.TODO(), 1)
+	go namespaceInformers.Start(config.Stop)
+
 	// Create and register the configurable route controller with the operator manager.
 	if _, err := configurableroutecontroller.New(mgr, configurableroutecontroller.Config{
 		SecretNamespace: operatorcontroller.GlobalUserSpecifiedConfigNamespace,