[release-4.12] OCPBUGS-3881: Default to legacy psa settings #426

openshift-cherrypick-robot · 2022-12-20T14:34:34Z

This is an automated cherry-pick of #420

/assign awgreene

The catalogSource api was recently updated to support running the associated pod in a "restricted" workflow as defined by the Pod Security Admission controller. By default, the catalogSource pods have been configured to run in "restricted" mode, which is disruptive to customers managing and deploying their own catalogSources as they need to rebuild their catalogs to run in "restricted" mode if a namespace is marked as "restricted". In an effort to provide users with a bit more time to rebuilt their catalogSources, this change configures catalogSources to run in "legacy" mode by default. A series of other changes will be made to update the namespaces associated with marketplace and olm to support catalogSources running in "legacy" mode by default. Signed-off-by: Alexander Greene <[email protected]> Upstream-repository: api Upstream-commit: 9fe16de3fd69800828decd67cf41ba9c5c773106

* Bump operator-framework/api v0.17.3 Signed-off-by: Alexander Greene <[email protected]> * Default to legacy PSA settings Problem: OLM recently introduced a few changes to default to running its workloads in a restricted mode. As a part of these changes, catalogSources built with earlier versions of OPM will not run as expected unless the catalogSource yaml is configured to run in a legacy version. Unfortunately, these legacy catalogs cannot be ran in restricted namespaces, which includes the `olm` namespace which is used to define global catalogSources. Solution: Provide users ample time to convert to the new restricted fromat by defaulting to legacy restrictions and reclassify the `olm` namespace as a baseline privilege namespace. Signed-off-by: Alexander Greene <[email protected]> * Update chart values and generate manifests Signed-off-by: Alexander Greene <[email protected]> Upstream-repository: operator-lifecycle-manager Upstream-commit: a0dab223ba55d714bc2f440dd7651870c37bc0c1

With the recent changes to default to legacy mode, some distributions of OLM are unable to run as the catalogSources are running in legacy mode in restricted namespaces. This commit configures the catalogSource pods in the e2e suite to run in restricted mode. Signed-off-by: Alexander Greene <[email protected]> Upstream-repository: operator-lifecycle-manager Upstream-commit: d82537cd54934878bb109fde5515e0efdf798e47

openshift-ci-robot · 2022-12-20T14:34:42Z

@openshift-cherrypick-robot: Jira Issue OCPBUGS-4757 has been cloned as Jira Issue OCPBUGS-5071. Retitling PR to link against new bug.
/retitle [release-4.12] OCPBUGS-5071: Default to legacy psa settings (#273)

In response to this:

This is an automated cherry-pick of #420

/assign awgreene

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2022-12-20T14:35:00Z

@openshift-cherrypick-robot: No Bugzilla bug is referenced in the title of this pull request.
To reference a bug, add 'Bug XXX:' to the title of this pull request and request another bug refresh with /bugzilla refresh.

In response to this:

[release-4.12] OCPBUGS-5071: Default to legacy psa settings (#273)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2022-12-20T14:35:03Z

@openshift-cherrypick-robot: This pull request references Jira Issue OCPBUGS-5071, which is valid. The bug has been moved to the POST state.

6 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.12.0) matches configured target version for branch (4.12.0)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)
dependent bug Jira Issue OCPBUGS-4757 is in the state Verified, which is one of the valid states (MODIFIED, ON_QA, VERIFIED)
dependent Jira Issue OCPBUGS-4757 targets the "4.13.0" version, which is one of the valid target versions: 4.13.0
bug has dependents

Requesting review from QA contact:
/cc @jianzhangbjz

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

This is an automated cherry-pick of #420

/assign awgreene

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

awgreene · 2022-12-20T14:40:43Z

/retitle [release-4.12] OCPBUGS-3881: Default to legacy psa settings

openshift-ci · 2022-12-20T14:40:49Z

@openshift-cherrypick-robot: No Bugzilla bug is referenced in the title of this pull request.
To reference a bug, add 'Bug XXX:' to the title of this pull request and request another bug refresh with /bugzilla refresh.

Retaining the bugzilla/valid-bug label as it was manually added.

In response to this:

[release-4.12] OCPBUGS-3881: Default to legacy psa settings

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2022-12-20T14:40:52Z

@openshift-cherrypick-robot: This pull request references Jira Issue OCPBUGS-3881, which is invalid:

expected Jira Issue OCPBUGS-3881 to depend on a bug targeting a version in 4.13.0 and in one of the following states: MODIFIED, ON_QA, VERIFIED, but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

This is an automated cherry-pick of #420

/assign awgreene

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

awgreene · 2022-12-20T14:42:07Z

/jira refresh

openshift-ci-robot · 2022-12-20T14:42:13Z

@awgreene: This pull request references Jira Issue OCPBUGS-3881, which is valid. The bug has been moved to the POST state.

6 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.12.0) matches configured target version for branch (4.12.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)
dependent bug Jira Issue OCPBUGS-4757 is in the state Verified, which is one of the valid states (MODIFIED, ON_QA, VERIFIED)
dependent Jira Issue OCPBUGS-4757 targets the "4.13.0" version, which is one of the valid target versions: 4.13.0
bug has dependents

Requesting review from QA contact:
/cc @jianzhangbjz

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

awgreene · 2022-12-20T17:14:25Z

/approve

openshift-ci · 2022-12-20T17:14:45Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: awgreene, openshift-cherrypick-robot

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [awgreene]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2022-12-20T17:25:11Z

@openshift-cherrypick-robot: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

awgreene · 2022-12-20T17:26:12Z

/label backport-risk-assesed

openshift-ci · 2022-12-20T17:26:15Z

@awgreene: The label(s) /label backport-risk-assesed cannot be applied. These labels are supported: platform/aws, platform/azure, platform/baremetal, platform/google, platform/libvirt, platform/openstack, ga, tide/merge-method-merge, tide/merge-method-rebase, tide/merge-method-squash, px-approved, docs-approved, qe-approved, downstream-change-needed, approved, backport-risk-assessed, bugzilla/valid-bug, cherry-pick-approved, jira/valid-bug, staff-eng-approved. Is this label configured under labels -> additional_labels or labels -> restricted_labels in plugin.yaml?

In response to this:

/label backport-risk-assesed

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

awgreene · 2022-12-20T17:26:53Z

/label backport-risk-assessed,

openshift-ci · 2022-12-20T17:26:55Z

@awgreene: The label(s) /label backport-risk-assessed, cannot be applied. These labels are supported: platform/aws, platform/azure, platform/baremetal, platform/google, platform/libvirt, platform/openstack, ga, tide/merge-method-merge, tide/merge-method-rebase, tide/merge-method-squash, px-approved, docs-approved, qe-approved, downstream-change-needed, approved, backport-risk-assessed, bugzilla/valid-bug, cherry-pick-approved, jira/valid-bug, staff-eng-approved. Is this label configured under labels -> additional_labels or labels -> restricted_labels in plugin.yaml?

In response to this:

/label backport-risk-assessed,

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

awgreene · 2022-12-20T17:27:30Z

/label backport-risk-assessed

oceanc80 · 2022-12-20T17:52:20Z

/lgtm

jianzhangbjz · 2022-12-21T02:19:40Z

Test passed, details: https://issues.redhat.com/browse/OCPBUGS-3881
/label qe-approved
/label cherry-pick-approved

openshift-ci-robot · 2022-12-21T02:24:45Z

@openshift-cherrypick-robot: All pull requests linked via external trackers have merged:

Jira Issue OCPBUGS-3881 has been moved to the MODIFIED state.

In response to this:

This is an automated cherry-pick of #420

/assign awgreene

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

awgreene added 4 commits December 20, 2022 14:34

Generate Downstream Manifests

b25f1b6

openshift-cherrypick-robot mentioned this pull request Dec 20, 2022

OCPBUGS-4757: Default to legacy psa settings (#273) #420

Merged

openshift-cherrypick-robot assigned awgreene Dec 20, 2022

openshift-ci bot changed the title ~~[release-4.12] OCPBUGS-4757: Default to legacy psa settings (#273)~~ [release-4.12] OCPBUGS-5071: Default to legacy psa settings (#273) Dec 20, 2022

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. labels Dec 20, 2022

openshift-ci bot requested review from jianzhangbjz, anik120 and dinhxuanvu December 20, 2022 14:35

openshift-ci bot changed the title ~~[release-4.12] OCPBUGS-5071: Default to legacy psa settings (#273)~~ [release-4.12] OCPBUGS-3881: Default to legacy psa settings Dec 20, 2022

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 20, 2022

openshift-ci bot added the backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. label Dec 20, 2022

openshift-ci bot assigned bandrade, jianzhangbjz, kuiwang02 and Xia-Zhao-rh Dec 20, 2022

openshift-ci bot assigned oceanc80 Dec 20, 2022

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Dec 20, 2022

openshift-ci bot added qe-approved Signifies that QE has signed off on this PR cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. labels Dec 21, 2022

openshift-merge-robot merged commit d6d2139 into openshift:release-4.12 Dec 21, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[release-4.12] OCPBUGS-3881: Default to legacy psa settings #426

[release-4.12] OCPBUGS-3881: Default to legacy psa settings #426

openshift-cherrypick-robot commented Dec 20, 2022

openshift-ci-robot commented Dec 20, 2022

openshift-ci bot commented Dec 20, 2022

openshift-ci-robot commented Dec 20, 2022

awgreene commented Dec 20, 2022

openshift-ci bot commented Dec 20, 2022

openshift-ci-robot commented Dec 20, 2022

awgreene commented Dec 20, 2022

openshift-ci-robot commented Dec 20, 2022

awgreene commented Dec 20, 2022

openshift-ci bot commented Dec 20, 2022

openshift-ci bot commented Dec 20, 2022

awgreene commented Dec 20, 2022

openshift-ci bot commented Dec 20, 2022

awgreene commented Dec 20, 2022

openshift-ci bot commented Dec 20, 2022

awgreene commented Dec 20, 2022

oceanc80 commented Dec 20, 2022

jianzhangbjz commented Dec 21, 2022

openshift-ci-robot commented Dec 21, 2022

[release-4.12] OCPBUGS-3881: Default to legacy psa settings #426

[release-4.12] OCPBUGS-3881: Default to legacy psa settings #426

Conversation

openshift-cherrypick-robot commented Dec 20, 2022

openshift-ci-robot commented Dec 20, 2022

openshift-ci bot commented Dec 20, 2022

openshift-ci-robot commented Dec 20, 2022

awgreene commented Dec 20, 2022

openshift-ci bot commented Dec 20, 2022

openshift-ci-robot commented Dec 20, 2022

awgreene commented Dec 20, 2022

openshift-ci-robot commented Dec 20, 2022

awgreene commented Dec 20, 2022

openshift-ci bot commented Dec 20, 2022

openshift-ci bot commented Dec 20, 2022

awgreene commented Dec 20, 2022

openshift-ci bot commented Dec 20, 2022

awgreene commented Dec 20, 2022

openshift-ci bot commented Dec 20, 2022

awgreene commented Dec 20, 2022

oceanc80 commented Dec 20, 2022

jianzhangbjz commented Dec 21, 2022

openshift-ci-robot commented Dec 21, 2022