Bug 1881520: avoid hotlooping on RoleBindings with empty APIGroup #562

vrutkovs · 2021-05-13T12:01:19Z

EnsureRoleBinding and EnsureClusterRoleBinding expect RoleRefs to be identical. Some manifests are skipping APIGroup, so CVO keeps attempting to apply those on every sync.

This PR adds CompareRoleRefsv1/CompareRoleRefsv1beta1 functions, which return true ("identical") if required APIGroup is empty and existing APIGroup is "rbac.authorization.k8s.io"

TODO:

More idiomatic would be ensureRoleRefAPIGroup
Add test case

openshift-ci · 2021-05-13T12:01:29Z

@vrutkovs: This pull request references Bugzilla bug 1881520, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.8.0) matches configured target release for branch (4.8.0)
bug is in the state NEW, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

Requesting review from QA contact:
/cc @jianlinliu

Details

In response to this:

Bug 1881520: avoid hotlooping on RoleBindings with empty APIGroup

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2021-05-13T12:33:12Z

@vrutkovs: This pull request references Bugzilla bug 1881520, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.8.0) matches configured target release for branch (4.8.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

Requesting review from QA contact:
/cc @jianlinliu

Details

In response to this:

Bug 1881520: avoid hotlooping on RoleBindings with empty APIGroup

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2021-05-13T12:57:05Z

@vrutkovs: This pull request references Bugzilla bug 1881520, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.8.0) matches configured target release for branch (4.8.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

Requesting review from QA contact:
/cc @jianlinliu

Details

In response to this:

Bug 1881520: avoid hotlooping on RoleBindings with empty APIGroup

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

wking

/lgtm

vrutkovs · 2021-05-13T13:34:34Z

/hold

This needs unit tests

openshift-ci · 2021-05-13T14:41:40Z

@vrutkovs: This pull request references Bugzilla bug 1881520, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.8.0) matches configured target release for branch (4.8.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

Requesting review from QA contact:
/cc @jianlinliu

Details

In response to this:

Bug 1881520: avoid hotlooping on RoleBindings with empty APIGroup

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

vrutkovs · 2021-05-13T17:00:01Z

/test unit

Flake?

vrutkovs · 2021-05-13T17:21:10Z

/hold cancel

Tests added, ready for review

wking · 2021-05-13T17:38:45Z

lib/resourcemerge/rbacv1beta1.go

@@ -1,6 +1,7 @@
 package resourcemerge


We might actually be able to drop this entirely, with:

$ oc adm release extract --to manifests quay.io/openshift-release-dev/ocp-release:4.8.0-fc.3-x86_64 $ grep -r10 v1beta1 manifests/ | grep ClusterRole manifests/0000_80_machine-config-operator_03_rbac.yaml-kind: ClusterRoleBinding manifests/0000_30_baremetal-operator_01_baremetalhost.crd.yaml-kind: ClusterRole

The MCO has since bumped their version and the baremetal manifest doesn't have annotations to be included in any cluster profiles. So I expect we can drop this entirely, instead of fixing v1beta1 hotlooping.

Part of dropping v1beta1 RBAC will be:

$ git --no-pager diff -U0 hack diff --git a/hack/generate-lib-resources.py b/hack/generate-lib-resources.py index 441e253d..294e9885 100755 --- a/hack/generate-lib-resources.py +++ b/hack/generate-lib-resources.py @@ -271 +270,0 @@ if __name__ == '__main__': - types['k8s.io/api/rbac/v1beta1'] = types['k8s.io/api/rbac/v1'] @@ -282 +280,0 @@ if __name__ == '__main__': - 'k8s.io/api/rbac/v1beta1': {'package': 'k8s.io/client-go/kubernetes/typed/rbac/v1beta1', 'type': 'RbacV1beta1Client'},

although you'll also want #552, and you'll need to drop some remaining v1beta1 RBAC code like this resourcemerge stuff by hand.

Good idea, dropped v1beta1

wking · 2021-05-13T17:47:12Z

lib/resourcemerge/rbacv1beta1.go

 package resourcemerge

 import (
+	rbacv1 "k8s.io/api/rbac/v1"


No need to mix in v1, v1beta1 has this too:

$ git --no-pager grep 'GroupName =' vendor/k8s.io/api/rbac/v1beta1 vendor/k8s.io/api/rbac/v1beta1/register.go:const GroupName = "rbac.authorization.k8s.io"

Some manifests skip setting APIGroup in clusterbinding roleRefs, which makes CVO hotloop on these. This ensures empty api groups are being defaulted

wking

/lgtm
/retest

openshift-ci · 2021-05-14T17:53:22Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: vrutkovs, wking

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [vrutkovs,wking]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-bot · 2021-05-14T21:34:50Z

/retest

Please review the full test history for this PR and help us cut down flakes.

wking · 2021-05-14T21:57:20Z

pods should successfully create sandboxes by other is not a CVO-RoleBinding-management failure.

/override ci/prow/e2e-agnostic-upgrade

openshift-ci · 2021-05-14T21:57:36Z

@wking: Overrode contexts on behalf of wking: ci/prow/e2e-agnostic-upgrade

Details

In response to this:

pods should successfully create sandboxes by other is not a CVO-RoleBinding-management failure.

/override ci/prow/e2e-agnostic-upgrade

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2021-05-14T23:27:22Z

@vrutkovs: All pull requests linked via external trackers have merged:

openshift/cluster-version-operator#562

Bugzilla bug 1881520 has been moved to the MODIFIED state.

Details

In response to this:

Bug 1881520: avoid hotlooping on RoleBindings with empty APIGroup

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

vrutkovs · 2021-06-08T10:14:23Z

/cherrypick release-4.7

openshift-cherrypick-robot · 2021-06-08T10:15:01Z

@vrutkovs: new pull request created: #584

Details

In response to this:

/cherrypick release-4.7

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci bot added the bugzilla/severity-high Referenced Bugzilla bug's severity is high for the branch this PR is targeting. label May 13, 2021

openshift-ci bot added the bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. label May 13, 2021

openshift-ci bot requested review from jianlinliu, smarterclayton and wking May 13, 2021 12:01

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 13, 2021

vrutkovs force-pushed the hotloop-rolebindings branch from 15b026d to bc4c6c6 Compare May 13, 2021 12:39

wking approved these changes May 13, 2021

View reviewed changes

openshift-ci bot assigned wking May 13, 2021

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label May 13, 2021

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 13, 2021

vrutkovs force-pushed the hotloop-rolebindings branch from bc4c6c6 to 8f28251 Compare May 13, 2021 14:41

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label May 13, 2021

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 13, 2021

wking reviewed May 13, 2021

View reviewed changes

rbac: set empty APIGroup for rbacv1 RoleRefs

ca5dee3

Some manifests skip setting APIGroup in clusterbinding roleRefs, which makes CVO hotloop on these. This ensures empty api groups are being defaulted

vrutkovs force-pushed the hotloop-rolebindings branch from 8f28251 to ca5dee3 Compare May 14, 2021 08:07

wking approved these changes May 14, 2021

View reviewed changes

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label May 14, 2021

openshift-merge-robot merged commit 00a4fd9 into openshift:master May 14, 2021

openshift-cherrypick-robot mentioned this pull request Jun 8, 2021

[release-4.7] Bug 1969378: avoid hotlooping on RoleBindings with empty APIGroup #584

Merged

Bug 1881520: avoid hotlooping on RoleBindings with empty APIGroup #562

Bug 1881520: avoid hotlooping on RoleBindings with empty APIGroup #562

Uh oh!

Conversation

vrutkovs commented May 13, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci bot commented May 13, 2021

Uh oh!

openshift-ci bot commented May 13, 2021

Uh oh!

openshift-ci bot commented May 13, 2021

Uh oh!

wking left a comment

Choose a reason for hiding this comment

Uh oh!

vrutkovs commented May 13, 2021

Uh oh!

openshift-ci bot commented May 13, 2021

Uh oh!

vrutkovs commented May 13, 2021

Uh oh!

vrutkovs commented May 13, 2021

Uh oh!

wking May 13, 2021

Choose a reason for hiding this comment

Uh oh!

wking May 13, 2021

Choose a reason for hiding this comment

Uh oh!

vrutkovs May 14, 2021

Choose a reason for hiding this comment

Uh oh!

wking May 13, 2021

Choose a reason for hiding this comment

Uh oh!

wking left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented May 14, 2021

Uh oh!

openshift-bot commented May 14, 2021

Uh oh!

wking commented May 14, 2021

Uh oh!

openshift-ci bot commented May 14, 2021

Uh oh!

openshift-ci bot commented May 14, 2021

Uh oh!

vrutkovs commented Jun 8, 2021

Uh oh!

openshift-cherrypick-robot commented Jun 8, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

vrutkovs commented May 13, 2021 •

edited

Loading