From aa2c49d5d637280c12f7707615cf97bfa1ddf033 Mon Sep 17 00:00:00 2001 From: Massimo Federico Bonfigli Date: Wed, 15 Jul 2026 22:18:19 +0200 Subject: [PATCH] =?UTF-8?q?OCPBUGS-98763:=20patch=20AWS=20master=20IAM=20r?= =?UTF-8?q?ole=20in=204.21/4.22=E2=86=925.0=20upgrade=20jobs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The OpenShift installer did not include elasticloadbalancing:SetSecurityGroups in the master IAM role policy until 4.23. Clusters installed with 4.21 or 4.22 and upgraded to 5.0 hit AccessDenied when the 5.0 CCM calls SetSecurityGroups on NLBs, since the master role is never updated during upgrade. Add a new step openshift-upgrade-aws-patch-master-iam that attaches a dedicated inline policy with the missing permission to the master role before the upgrade test runs. Wire it into the test phase of the three affected jobs: - periodic-ci-openshift-release-main-ci-5.0-upgrade-from-stable-4.22-e2e-aws-ovn-upgrade - periodic-ci-openshift-release-main-ci-5.0-upgrade-from-stable-4.22-from-stable-4.21-e2e-aws-ovn-upgrade - periodic-ci-openshift-release-main-nightly-5.0-upgrade-from-stable-4.21-e2e-aws-ovn-upgrade-paused Co-Authored-By: Claude Sonnet 4.6 (1M context) --- ...ft-upgrade-aws-heterogeneous-workflow.yaml | 1 + .../aws/openshift-upgrade-aws-workflow.yaml | 1 + .../openshift-upgrade-aws-ovn-workflow.yaml | 1 + .../upgrade/aws/patch-master-iam/OWNERS | 5 ++ ...t-upgrade-aws-patch-master-iam-commands.sh | 52 +++++++++++++++++++ ...ade-aws-patch-master-iam-ref.metadata.json | 11 ++++ ...hift-upgrade-aws-patch-master-iam-ref.yaml | 17 ++++++ ...ft-upgrade-aws-pausedworkers-workflow.yaml | 1 + .../openshift-upgrade-aws-runc-workflow.yaml | 1 + ...hift-upgrade-aws-single-node-workflow.yaml | 1 + ...ade-aws-single-node-realtime-workflow.yaml | 1 + ...upgrade-aws-storage-symlinks-workflow.yaml | 1 + 12 files changed, 93 insertions(+) create mode 100644 ci-operator/step-registry/openshift/upgrade/aws/patch-master-iam/OWNERS create mode 100755 ci-operator/step-registry/openshift/upgrade/aws/patch-master-iam/openshift-upgrade-aws-patch-master-iam-commands.sh create mode 100644 ci-operator/step-registry/openshift/upgrade/aws/patch-master-iam/openshift-upgrade-aws-patch-master-iam-ref.metadata.json create mode 100644 ci-operator/step-registry/openshift/upgrade/aws/patch-master-iam/openshift-upgrade-aws-patch-master-iam-ref.yaml diff --git a/ci-operator/step-registry/openshift/upgrade/aws/heterogeneous/openshift-upgrade-aws-heterogeneous-workflow.yaml b/ci-operator/step-registry/openshift/upgrade/aws/heterogeneous/openshift-upgrade-aws-heterogeneous-workflow.yaml index 52f267deb455c..26bddefe75f28 100644 --- a/ci-operator/step-registry/openshift/upgrade/aws/heterogeneous/openshift-upgrade-aws-heterogeneous-workflow.yaml +++ b/ci-operator/step-registry/openshift/upgrade/aws/heterogeneous/openshift-upgrade-aws-heterogeneous-workflow.yaml @@ -5,6 +5,7 @@ workflow: pre: - chain: ipi-aws-pre-stableinitial - ref: ipi-install-heterogeneous + - ref: openshift-upgrade-aws-patch-master-iam test: - ref: openshift-e2e-test post: diff --git a/ci-operator/step-registry/openshift/upgrade/aws/openshift-upgrade-aws-workflow.yaml b/ci-operator/step-registry/openshift/upgrade/aws/openshift-upgrade-aws-workflow.yaml index b371f63f852ff..40cea90112dd6 100644 --- a/ci-operator/step-registry/openshift/upgrade/aws/openshift-upgrade-aws-workflow.yaml +++ b/ci-operator/step-registry/openshift/upgrade/aws/openshift-upgrade-aws-workflow.yaml @@ -4,6 +4,7 @@ workflow: allow_best_effort_post_steps: true pre: - chain: ipi-aws-pre-stableinitial + - ref: openshift-upgrade-aws-patch-master-iam test: - ref: openshift-e2e-test post: diff --git a/ci-operator/step-registry/openshift/upgrade/aws/ovn/openshift-upgrade-aws-ovn-workflow.yaml b/ci-operator/step-registry/openshift/upgrade/aws/ovn/openshift-upgrade-aws-ovn-workflow.yaml index c6f8c803f611e..59465ff70027b 100644 --- a/ci-operator/step-registry/openshift/upgrade/aws/ovn/openshift-upgrade-aws-ovn-workflow.yaml +++ b/ci-operator/step-registry/openshift/upgrade/aws/ovn/openshift-upgrade-aws-ovn-workflow.yaml @@ -6,6 +6,7 @@ workflow: - chain: ipi-conf-aws - ref: ovn-conf - chain: ipi-install-stableinitial + - ref: openshift-upgrade-aws-patch-master-iam test: - ref: openshift-e2e-test post: diff --git a/ci-operator/step-registry/openshift/upgrade/aws/patch-master-iam/OWNERS b/ci-operator/step-registry/openshift/upgrade/aws/patch-master-iam/OWNERS new file mode 100644 index 0000000000000..8709b61a039b3 --- /dev/null +++ b/ci-operator/step-registry/openshift/upgrade/aws/patch-master-iam/OWNERS @@ -0,0 +1,5 @@ +approvers: +- mtulio +- mfbonfigli +- tthvo +- patrickdillon \ No newline at end of file diff --git a/ci-operator/step-registry/openshift/upgrade/aws/patch-master-iam/openshift-upgrade-aws-patch-master-iam-commands.sh b/ci-operator/step-registry/openshift/upgrade/aws/patch-master-iam/openshift-upgrade-aws-patch-master-iam-commands.sh new file mode 100755 index 0000000000000..c2783720bf848 --- /dev/null +++ b/ci-operator/step-registry/openshift/upgrade/aws/patch-master-iam/openshift-upgrade-aws-patch-master-iam-commands.sh @@ -0,0 +1,52 @@ +#!/bin/bash +set -euo pipefail + +if test -f "${SHARED_DIR}/proxy-conf.sh"; then + # shellcheck disable=SC1091 + source "${SHARED_DIR}/proxy-conf.sh" +fi + +export KUBECONFIG="${SHARED_DIR}/kubeconfig" + +SOURCE_VERSION=$(oc get clusterversion version -o jsonpath='{.status.desired.version}') +SOURCE_MAJOR=$(echo "${SOURCE_VERSION}" | cut -d. -f1) + +TARGET_VERSION=$(oc adm release info "${OPENSHIFT_UPGRADE_RELEASE_IMAGE_OVERRIDE:-}" \ + --output=json 2>/dev/null | jq -r '.metadata.version') || { + echo "WARNING: could not determine target version, skipping patch." + exit 0 +} +TARGET_MAJOR=$(echo "${TARGET_VERSION}" | cut -d. -f1) + +if [[ "${SOURCE_MAJOR}" != "4" || "${TARGET_MAJOR}" != "5" ]]; then + echo "Not a 4.x to 5.x upgrade (${SOURCE_VERSION} to ${TARGET_VERSION}), skipping." + exit 0 +fi + +echo "Detected 4.x to 5.x upgrade (${SOURCE_VERSION} to ${TARGET_VERSION}), patching master IAM role." + +export AWS_SHARED_CREDENTIALS_FILE="${CLUSTER_PROFILE_DIR}/.awscred" +REGION="${LEASED_RESOURCE}" +INFRA_ID=$(jq -r '.infraID' "${SHARED_DIR}/metadata.json") +MASTER_ROLE="${INFRA_ID}-master-role" +POLICY_NAME="${INFRA_ID}-master-upgrade-policy" + +echo "Adding inline policy ${POLICY_NAME} to role: ${MASTER_ROLE}" + +aws --region "${REGION}" iam put-role-policy \ + --role-name "${MASTER_ROLE}" \ + --policy-name "${POLICY_NAME}" \ + --policy-document '{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "elasticloadbalancing:SetSecurityGroups" + ], + "Resource": "*" + } + ] + }' + +echo "Successfully added inline policy ${POLICY_NAME} to ${MASTER_ROLE}" diff --git a/ci-operator/step-registry/openshift/upgrade/aws/patch-master-iam/openshift-upgrade-aws-patch-master-iam-ref.metadata.json b/ci-operator/step-registry/openshift/upgrade/aws/patch-master-iam/openshift-upgrade-aws-patch-master-iam-ref.metadata.json new file mode 100644 index 0000000000000..8f1ff33a4cd69 --- /dev/null +++ b/ci-operator/step-registry/openshift/upgrade/aws/patch-master-iam/openshift-upgrade-aws-patch-master-iam-ref.metadata.json @@ -0,0 +1,11 @@ +{ + "path": "openshift/upgrade/aws/patch-master-iam/openshift-upgrade-aws-patch-master-iam-ref.yaml", + "owners": { + "approvers": [ + "mtulio", + "mfbonfigli", + "tthvo", + "patrickdillon" + ] + } +} \ No newline at end of file diff --git a/ci-operator/step-registry/openshift/upgrade/aws/patch-master-iam/openshift-upgrade-aws-patch-master-iam-ref.yaml b/ci-operator/step-registry/openshift/upgrade/aws/patch-master-iam/openshift-upgrade-aws-patch-master-iam-ref.yaml new file mode 100644 index 0000000000000..b98a1ea86099f --- /dev/null +++ b/ci-operator/step-registry/openshift/upgrade/aws/patch-master-iam/openshift-upgrade-aws-patch-master-iam-ref.yaml @@ -0,0 +1,17 @@ +ref: + as: openshift-upgrade-aws-patch-master-iam + from_image: + namespace: ocp + name: "5.0" + tag: upi-installer + commands: openshift-upgrade-aws-patch-master-iam-commands.sh + resources: + requests: + cpu: 10m + memory: 100Mi + dependencies: + - name: "release:latest" + env: OPENSHIFT_UPGRADE_RELEASE_IMAGE_OVERRIDE + documentation: |- + Patches the AWS master IAM role to add permissions introduced after the + initial install version. \ No newline at end of file diff --git a/ci-operator/step-registry/openshift/upgrade/aws/pausedworkers/openshift-upgrade-aws-pausedworkers-workflow.yaml b/ci-operator/step-registry/openshift/upgrade/aws/pausedworkers/openshift-upgrade-aws-pausedworkers-workflow.yaml index 0dd730aef0ab2..4c7b79e2235ee 100644 --- a/ci-operator/step-registry/openshift/upgrade/aws/pausedworkers/openshift-upgrade-aws-pausedworkers-workflow.yaml +++ b/ci-operator/step-registry/openshift/upgrade/aws/pausedworkers/openshift-upgrade-aws-pausedworkers-workflow.yaml @@ -4,6 +4,7 @@ workflow: allow_best_effort_post_steps: true pre: - chain: ipi-aws-pre-stableinitial + - ref: openshift-upgrade-aws-patch-master-iam test: - ref: openshift-e2e-test post: diff --git a/ci-operator/step-registry/openshift/upgrade/aws/runc/openshift-upgrade-aws-runc-workflow.yaml b/ci-operator/step-registry/openshift/upgrade/aws/runc/openshift-upgrade-aws-runc-workflow.yaml index eedade09a8aa9..32e075e1ed35c 100644 --- a/ci-operator/step-registry/openshift/upgrade/aws/runc/openshift-upgrade-aws-runc-workflow.yaml +++ b/ci-operator/step-registry/openshift/upgrade/aws/runc/openshift-upgrade-aws-runc-workflow.yaml @@ -7,6 +7,7 @@ workflow: - ref: openshift-manifests-runc - ref: ovn-conf - chain: ipi-install-stableinitial + - ref: openshift-upgrade-aws-patch-master-iam test: - ref: openshift-e2e-test post: diff --git a/ci-operator/step-registry/openshift/upgrade/aws/single-node/openshift-upgrade-aws-single-node-workflow.yaml b/ci-operator/step-registry/openshift/upgrade/aws/single-node/openshift-upgrade-aws-single-node-workflow.yaml index 6984a240d85c3..1718f4003c499 100644 --- a/ci-operator/step-registry/openshift/upgrade/aws/single-node/openshift-upgrade-aws-single-node-workflow.yaml +++ b/ci-operator/step-registry/openshift/upgrade/aws/single-node/openshift-upgrade-aws-single-node-workflow.yaml @@ -6,6 +6,7 @@ workflow: - chain: ipi-conf-aws - ref: single-node-conf-aws - chain: ipi-install-stableinitial + - ref: openshift-upgrade-aws-patch-master-iam test: - ref: single-node-e2e-test post: diff --git a/ci-operator/step-registry/openshift/upgrade/aws/single-node/realtime/openshift-upgrade-aws-single-node-realtime-workflow.yaml b/ci-operator/step-registry/openshift/upgrade/aws/single-node/realtime/openshift-upgrade-aws-single-node-realtime-workflow.yaml index 0506b333d2602..cf0d1a31155ec 100644 --- a/ci-operator/step-registry/openshift/upgrade/aws/single-node/realtime/openshift-upgrade-aws-single-node-realtime-workflow.yaml +++ b/ci-operator/step-registry/openshift/upgrade/aws/single-node/realtime/openshift-upgrade-aws-single-node-realtime-workflow.yaml @@ -8,6 +8,7 @@ workflow: - ref: single-node-conf-aws - chain: ipi-install-stableinitial - ref: single-node-conf-realtime + - ref: openshift-upgrade-aws-patch-master-iam test: - ref: single-node-e2e-test post: diff --git a/ci-operator/step-registry/openshift/upgrade/aws/storage-symlinks/openshift-upgrade-aws-storage-symlinks-workflow.yaml b/ci-operator/step-registry/openshift/upgrade/aws/storage-symlinks/openshift-upgrade-aws-storage-symlinks-workflow.yaml index 1d718e0f14b12..a373bb0607712 100644 --- a/ci-operator/step-registry/openshift/upgrade/aws/storage-symlinks/openshift-upgrade-aws-storage-symlinks-workflow.yaml +++ b/ci-operator/step-registry/openshift/upgrade/aws/storage-symlinks/openshift-upgrade-aws-storage-symlinks-workflow.yaml @@ -4,6 +4,7 @@ workflow: allow_best_effort_post_steps: true pre: - chain: ipi-aws-pre-stableinitial + - ref: openshift-upgrade-aws-patch-master-iam test: - ref: storage-disk-symlinks-save - ref: openshift-e2e-test