OCPBUGS-64822: block upgrades for conflict non-default ClusterImagePolicy resources#5414
Conversation
openshift-merge-robot
added
the
needs-rebase
QiWang19
force-pushed
the
cip-guard-upgrade
branch
from
29527c7 to
8aa4b16
Compare
openshift-merge-robot
removed
the
needs-rebase
QiWang19
changed the title
openshift-ci-robot
added
jira/valid-reference
|
@QiWang19: This pull request references Jira Issue OCPBUGS-64822, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@QiWang19: This pull request references Jira Issue OCPBUGS-64822, which is valid. 7 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/test e2e-aws-ovn-techpreview |
|
@QiWang19: The specified target(s) for The following commands are available to trigger optional jobs: Use DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/payload-job periodic-ci-openshift-release-master-ci-4.20-e2e-aws-ovn-techpreview |
|
@QiWang19: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/cc9c00e0-c0a8-11f0-8b11-4184cda435c8-0 |
QiWang19
force-pushed
the
cip-guard-upgrade
branch
3 times, most recently
from
0ca20b7 to
6203102
Compare
|
/payload-job periodic-ci-openshift-release-master-ci-4.20-e2e-aws-ovn-techpreview |
|
@QiWang19: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/f6a9e450-c0b8-11f0-83d8-cdc5a82ee9c5-0 |
|
/payload-job periodic-ci-openshift-release-master-ci-4.20-e2e-aws-ovn-techpreview |
|
@QiWang19: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/c2505fa0-c3f0-11f0-9f37-7713c0102c8d-0 |
QiWang19
force-pushed
the
cip-guard-upgrade
branch
from
1f06615 to
e285e21
Compare
/retest-required |
|
/payload-job periodic-ci-openshift-release-master-ci-4.20-e2e-aws-ovn-techpreview |
|
@QiWang19: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/2c2720c0-c48d-11f0-8ace-4338ea8bfe20-0 |
QiWang19
force-pushed
the
cip-guard-upgrade
branch
from
e285e21 to
aa13e2d
Compare
|
/payload-job periodic-ci-openshift-release-master-ci-4.20-e2e-aws-ovn-techpreview |
|
@QiWang19: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/2efab780-c71c-11f0-9899-7c55182f5127-0 |
|
@QiWang19: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
openshift-ci-robot
added
the
verified
|
@QiWang19: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
tests passed, we can use SigstoreImageVerificationPKI as an featureset indicator: if it's disabled, the cluster is on Default feature set. |
|
@wking the techpreview job looks good. https://prow.ci.openshift.org/view/gs/test-platform-results/logs/openshift-machine-config-operator-5414-ci-4.20-e2e-aws-ovn-techpreview/1991973383591432192 |
|
I dunno what's going on with bootstrap-unit: But, the job as a whole seems pretty dead, so maybe unrelated to this change? |
wking
left a comment
wking
left a comment
There was a problem hiding this comment.
Testing with a Cluster Bot launch 4.20,openshift/machine-config-operator#5414 aws cluster (logs):
$ curl -s https://raw.githubusercontent.com/openshift/cluster-update-keys/b3cae8f22b51d9062d0ceb6ac9cf2f7651b4ce8f/manifests.rhel/0000_90_openshift-cluster-image-policy.yaml >policy.yaml
$ oc apply -f policy.yaml
$ oc get -o json clusterimagepolicy openshift | jq -r .metadata.creationTimestamp
2025-11-26T23:36:42Z
$ oc get -o json clusteroperator machine-config | jq '.status.conditions[] | select(.type == "Upgradeable")'
{
"lastTransitionTime": "2025-11-26T23:36:44Z",
"message": "ClusterImagePolicy resource named 'openshift' conflicts with the cluster default ClusterImagePolicy object and blocks upgrades. Please delete the 'openshift' ClusterImagePolicy resource and reapply it with a different name if needed",
"reason": "ConflictingClusterImagePolicy",
"status": "False",
"type": "Upgradeable"
}So looks good to me (and only took 2s to notice :) ). Also picks up deletion:
$ oc delete clusterimagepolicy openshift
$ oc get -o json clusteroperator machine-config | jq '.status.conditions[] | select(.type == "Upgradeable")'
{
"lastTransitionTime": "2025-11-26T23:40:06Z",
"reason": "AsExpected",
"status": "True",
"type": "Upgradeable"
}Thanks!
/lgtm
isabella-janssen
left a comment
isabella-janssen
left a comment
There was a problem hiding this comment.
/approve
/label backport-risk-assessed
Change looks good & test previously failing looks to be passing.
openshift-ci
bot
added
the
backport-risk-assessed
openshift-ci
bot
assigned
anuragthehatter,
eurijon,
imatza-rh,
lyman9966,
mhanss,
ptalgulk01,
rbbratta,
rioliu-rh and
sergiordlr
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: isabella-janssen, QiWang19, wking The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
|
/retest-required |
openshift-merge-bot
bot
merged commit 5fe9249
into
openshift:release-4.20
|
@QiWang19: Jira Issue Verification Checks: Jira Issue OCPBUGS-64822 Jira Issue OCPBUGS-64822 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Fix included in accepted release 4.20.0-0.nightly-2025-12-02-131357 |
14 participants
- What I did
- How to verify it
Delete the self created testing clusterimagepolicy, turn on the featuregate, should not have Upgradeable=False guard on openshift internal
openshiftpolicy- Description for the changelog