Skip to content

STOR-1443: Sync 05_operator_role-hypershift.yaml manifest from cluster-csi-snapsht-controller-operator - #2915

Merged
openshift-merge-robot merged 1 commit into
openshift:mainfrom
mpatlasov:sync-manifest-for-cluster-csi-snapshot-controller-operator
Aug 17, 2023
Merged

STOR-1443: Sync 05_operator_role-hypershift.yaml manifest from cluster-csi-snapsht-controller-operator#2915
openshift-merge-robot merged 1 commit into
openshift:mainfrom
mpatlasov:sync-manifest-for-cluster-csi-snapshot-controller-operator

Conversation

@mpatlasov

@mpatlasov mpatlasov commented Aug 16, 2023

Copy link
Copy Markdown
Contributor

What this PR does / why we need it:

The PR implements restarting csi-snapshot-webhook if the secret csi-snapshot-webhook-secret is updated. To do it, the operator needs to monitor for secret updates. This requires new perms in 05_operator_role-hypershift.yaml. This PR simply syncs those changes to hypershift repo manifest.

/cc @openshift/storage

Checklist

  • [*] Subject and description added to both, commit and PR.
  • [*] Relevant issues have been referenced.
  • This change includes docs.
  • This change includes unit tests.

@mpatlasov
STOR-1443: Sync 05_operator_role-hypershift.yaml manifest from clus…
28da0fa 
…ter-csi-snapsht-controller-operator

The operator needs perms to monitor secret (`csi-snapshot-webhook-secret`) updates.
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 16, 2023
@openshift-ci-robot

openshift-ci-robot commented Aug 16, 2023 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown

@mpatlasov: This pull request references STOR-1443 which is a valid jira issue.

Details

In response to this:

What this PR does / why we need it:

The PR implements restarting csi-snapshot-webhook if the secret csi-snapshot-webhook-secret is updated. To do it, the operator needs to monitor for secret updates. This requires new perms in 05_operator_role-hypershift.yaml. This PR simply syncs those changes to hypershift repo manifest.

/cc @openshift/storage

Checklist

  • [*] Subject and description added to both, commit and PR.
  • [*] Relevant issues have been referenced.
  • This change includes docs.
  • This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci

openshift-ci Bot commented Aug 16, 2023

Copy link
Copy Markdown
Contributor

@mpatlasov: GitHub didn't allow me to request PR reviews from the following users: openshift/storage.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

What this PR does / why we need it:

The PR implements restarting csi-snapshot-webhook if the secret csi-snapshot-webhook-secret is updated. To do it, the operator needs to monitor for secret updates. This requires new perms in 05_operator_role-hypershift.yaml. This PR simply syncs those changes to hypershift repo manifest.

/cc @openshift/storage

Checklist

  • [*] Subject and description added to both, commit and PR.
  • [*] Relevant issues have been referenced.
  • This change includes docs.
  • This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci openshift-ci Bot added do-not-merge/needs-area area/control-plane-operator Indicates the PR includes changes for the control plane operator - in an OCP release and removed do-not-merge/needs-area labels Aug 16, 2023
@mpatlasov mpatlasov mentioned this pull request Aug 16, 2023
Merged
@mpatlasov

mpatlasov commented Aug 16, 2023

Copy link
Copy Markdown
Contributor Author

/test e2e-aws
/test e2e-kubevirt-aws-ovn

1 similar comment
@mpatlasov

mpatlasov commented Aug 16, 2023

Copy link
Copy Markdown
Contributor Author

/test e2e-aws
/test e2e-kubevirt-aws-ovn

cblecker
cblecker reviewed Aug 17, 2023
View reviewed changes
Comment thread ...or/controllers/hostedcontrolplane/snapshotcontroller/assets/05_operator_role-hypershift.yaml
- update
- apiGroups:
- ""
resources:

@cblecker cblecker Aug 17, 2023

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this need access to all secrets in the namespace, or can we narrow this down to specific resource names?

@csrwng csrwng Aug 17, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is only a role (as opposed to clusterrole), so only applies to the namespace where it lives

@cblecker cblecker Aug 17, 2023

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@csrwng I know. My question still stands -- does this role require access to all secrets in the namespace, or if it's looking at one specific secret (the description says csi-snapshot-webhook-secret) then can we add a resource name to scope the access to that?

@mpatlasov mpatlasov Aug 17, 2023

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's how Informers (openshift/cluster-csi-snapshot-controller-operator@2770991#diff-0d623dfd885adb20f991bda4c2453aebd732ca6dbb4d1d4be6e79805c3b48de6R259) work. We can narrow down list-n-watch to specific namespace, but not to specific secret in namespace. I don't know if it's implementation restriction of Informers or API server itself.

@mpatlasov

mpatlasov commented Aug 17, 2023

Copy link
Copy Markdown
Contributor Author

/test e2e-kubevirt-aws-ovn

@csrwng

csrwng commented Aug 17, 2023

Copy link
Copy Markdown
Contributor

/approve

@openshift-ci

openshift-ci Bot commented Aug 17, 2023

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: csrwng, mpatlasov

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 17, 2023
@jsafrane

jsafrane commented Aug 17, 2023

Copy link
Copy Markdown
Contributor

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 17, 2023
@openshift-ci-robot

openshift-ci-robot commented Aug 17, 2023

Copy link
Copy Markdown

/retest-required

Remaining retests: 0 against base HEAD 2583146 and 2 for PR HEAD 28da0fa in total

@openshift-ci

openshift-ci Bot commented Aug 17, 2023

Copy link
Copy Markdown
Contributor

@mpatlasov: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-kubevirt-aws-ovn 28da0fa link false /test e2e-kubevirt-aws-ovn

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@openshift-merge-robot
openshift-merge-robot merged commit d597d90 into openshift:main Aug 17, 2023
@mpatlasov mpatlasov mentioned this pull request Aug 23, 2023
Closed
2 tasks
@ShazaAldawamneh ShazaAldawamneh mentioned this pull request Jul 7, 2026
Merged
4 tasks
ShazaAldawamneh added a commit to ShazaAldawamneh/hypershift that referenced this pull request Aug 12, 2026
@ShazaAldawamneh
feat: Promote ExternalOIDCWithUpstreamParity to Default feature set
7b8bef2 
Promote the ExternalOIDCWithUpstreamParity feature gate from
TechPreviewNoUpgrade to the Default feature set, enabling upstream
parity authentication configuration by default.

This change aligns with the openshift/api promotion in PR openshift#2915 and
allows the feature to be available in the default feature set once
the API changes are merged.

Signed-off-by: Shaza Aldawamneh <shaza.aldawamneh@hotmail.com>
ShazaAldawamneh added a commit to ShazaAldawamneh/hypershift that referenced this pull request Aug 12, 2026
@ShazaAldawamneh
feat: Promote ExternalOIDCWithUpstreamParity to Default feature set
af19da4 
Promote the ExternalOIDCWithUpstreamParity feature gate from
TechPreviewNoUpgrade to the Default feature set, enabling upstream
parity authentication configuration by default.

This change aligns with the openshift/api promotion in PR openshift#2915 and
allows the feature to be available in the default feature set once
the API changes are merged.

Signed-off-by: Shaza Aldawamneh <shaza.aldawamneh@hotmail.com>
ShazaAldawamneh added a commit to ShazaAldawamneh/hypershift that referenced this pull request Aug 12, 2026
@ShazaAldawamneh
feat: Promote ExternalOIDCWithUpstreamParity to Default feature set
b1446d9 
Promote the ExternalOIDCWithUpstreamParity feature gate from
TechPreviewNoUpgrade to the Default feature set, enabling upstream
parity authentication configuration by default.

This change aligns with the openshift/api promotion in PR openshift#2915 and
allows the feature to be available in the default feature set once
the API changes are merged.

Signed-off-by: Shaza Aldawamneh <shaza.aldawamneh@hotmail.com>
vsolanki12 pushed a commit to vsolanki12/hypershift that referenced this pull request Aug 25, 2026
@ShazaAldawamneh @vsolanki12
feat: Promote ExternalOIDCWithUpstreamParity to Default feature set
cb4bd83 
Promote the ExternalOIDCWithUpstreamParity feature gate from
TechPreviewNoUpgrade to the Default feature set, enabling upstream
parity authentication configuration by default.

This change aligns with the openshift/api promotion in PR openshift#2915 and
allows the feature to be available in the default feature set once
the API changes are merged.

Signed-off-by: Shaza Aldawamneh <shaza.aldawamneh@hotmail.com>
rutvik23 pushed a commit to rutvik23/hypershift that referenced this pull request Aug 26, 2026
@ShazaAldawamneh @rutvik23
feat: Promote ExternalOIDCWithUpstreamParity to Default feature set
d9c351f 
Promote the ExternalOIDCWithUpstreamParity feature gate from
TechPreviewNoUpgrade to the Default feature set, enabling upstream
parity authentication configuration by default.

This change aligns with the openshift/api promotion in PR openshift#2915 and
allows the feature to be available in the default feature set once
the API changes are merged.

Signed-off-by: Shaza Aldawamneh <shaza.aldawamneh@hotmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@csrwng csrwng csrwng left review comments
+1 more reviewer
@cblecker cblecker cblecker left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@jsafrane jsafrane

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. area/control-plane-operator Indicates the PR includes changes for the control plane operator - in an OCP release jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@mpatlasov @openshift-ci-robot @csrwng @jsafrane @cblecker @openshift-merge-robot