Skip to content

OCPBUGS-97830: Add wait-for-etcd init container to oauth-apiserver #8940

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 1 commit into from
Jul 15, 2026
Merged

OCPBUGS-97830: Add wait-for-etcd init container to oauth-apiserver #8940

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions .../AROSwift/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

24 changes: 24 additions & 0 deletions ...erver/GCP/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

18 changes: 18 additions & 0 deletions .../IBMCloud/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

18 changes: 18 additions & 0 deletions ...NoUpgrade/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

18 changes: 18 additions & 0 deletions ...apiserver/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

17 changes: 17 additions & 0 deletions ...erator/controllers/hostedcontrolplane/v2/assets/openshift-oauth-apiserver/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,6 +126,23 @@ spec:
volumeMounts:
- mountPath: /var/log/openshift-oauth-apiserver
name: work-logs
initContainers:
- args:
- -c
- |
#!/bin/sh
while ! nslookup etcd-client.$(POD_NAMESPACE).svc; do sleep 1; done

@ironcladlou ironcladlou Jul 9, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is the goal to check for DNS resolution or actual connectivity to the endpoint?

@bryan-cox bryan-cox Jul 9, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

DNS resolution, not connectivity. The failure mode is that oauth-apiserver tries to connect to etcd-client before the Service has a backing Endpoints object (DNS returns NXDOMAIN), then exits with "context deadline exceeded" after 20s. Once DNS resolves, kube-proxy rules handle L4 connectivity. This mirrors the existing kube-apiserver wait-for-etcd init container which uses the same nslookup check.

Also merged the duplicate Unmanaged condition checks in deployment.go per a coderabbit nit.

AI-assisted response via Claude Code

command:
- /bin/bash
env:
- name: POD_NAMESPACE
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: metadata.namespace
image: cli
imagePullPolicy: IfNotPresent
name: wait-for-etcd
terminationGracePeriodSeconds: 120
volumes:
- emptyDir: {}
Expand Down
2 changes: 2 additions & 0 deletions control-plane-operator/controllers/hostedcontrolplane/v2/oauth_apiserver/deployment.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,9 @@ func adaptDeployment(cpContext component.WorkloadContext, deployment *appsv1.Dep
if err != nil {
return err
}
podspec.RemoveInitContainer("wait-for-etcd", &deployment.Spec.Template.Spec)

@jparrill jparrill Jul 13, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The placement works, but KAS keeps init container removal in its own self-documenting block with an explanatory comment (kas/deployment.go:105-110). Nesting it inside the hostname-resolution block makes it look like a side-effect of URL parsing rather than an intentional design decision.

Consider:

// With managed etcd, we should wait for the known etcd client service name to
// at least resolve before starting up to avoid futile connection attempts and
// pod crashing. For unmanaged, make no assumptions.
if cpContext.HCP.Spec.Etcd.ManagementType == hyperv1.Unmanaged {
    podspec.RemoveInitContainer("wait-for-etcd", &deployment.Spec.Template.Spec)
}

Nit, not blocking — just consistency with KAS.

}

noProxy := []string{
manifests.KubeAPIServerService("").Name,
etcdHostname,
Expand Down