capability: disallow disabling, add enabling capabilities #754
Conversation
openshift-ci
bot
added
the
do-not-merge/work-in-progress
openshift-ci
bot
added
the
approved
jottofar
force-pushed
the
ota-572
branch
2 times, most recently
from
2755007 to
edbfc53
Compare
|
/retitle WIP: capability: disallow disabling, add enabling capabilities |
openshift-ci
bot
changed the title
|
/test e2e-agnostic |
jottofar
force-pushed
the
ota-572
branch
2 times, most recently
from
708748f to
8547179
Compare
jottofar
force-pushed
the
ota-572
branch
4 times, most recently
from
90820b1 to
926f63e
Compare
|
/test unit |
|
/retest |
1 similar comment
|
/retest |
jottofar
force-pushed
the
ota-572
branch
5 times, most recently
from
8b88c36 to
94c43de
Compare
|
/retest |
Correct. Saving it off before it's overwritten by |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jottofar, wking The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
|
MCD /override ci/prow/e2e-agnostic-upgrade |
|
@wking: Overrode contexts on behalf of wking: ci/prow/e2e-agnostic-upgrade DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
@jottofar: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
5 participants
This PR adds support for the following per the. Post-install, an admin can change a capability to enable it but cannot disable a previously enabled capability. This PR changes CVO to override any admin attempt to disable a previously enabled capability and reports any such action through a newly added condition showing these "tainted-in" capabilities. These "tainted-in" capabilities will remain enabled and will be reported as such in the status.
Supporting this new logic requires that capability filtering be moved from payload load time to payload apply time in a similar fashion to how overrides are handled.