[release-4.19] NE-2286: Backport noOLM / Sail Library to release-4.19#1460
[release-4.19] NE-2286: Backport noOLM / Sail Library to release-4.19#1460gcs278 wants to merge 16 commits into
Conversation
Vendor the GatewayAPIWithoutOLM in the openshift/api repo to support backporting the No OLM logic into the release-4.19 branch. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
openshift-ci-robot
added
the
jira/valid-reference
|
@gcs278: This pull request references NE-2286 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target either version "4.19." or "openshift-4.19.", but it targets "openshift-4.22" instead. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Omit the namespace for the istios resource in relatedObjects as the istios resource is cluster-scoped. * pkg/operator/controller/status/controller.go (Reconcile): Remove the namespace for istios.
Omit the namespace for the gateways resource in relatedObjects as Istio manages gateways in all namespaces. * pkg/operator/controller/status/controller.go (Reconcile): Remove the namespace for gateways.
* pkg/operator/controller/status/controller.go (Reconcile): Pass ctx to getOperatorState. * pkg/operator/controller/status/controller.go (getOperatorState): Add a parameter for ctx, and use it instead of context.TODO().
Check whether the gatewayclasses, gateways, and istios CRDs actually exist before adding them to relatedObjects. Watch customresourcedefinitions in the status controller so that it updates relatedObjects as these CRDs are created. Check the "GatewayAPIController" featuregate to determine whether to add the gatewayclasses, gateways, istios, and subscriptions resources to relatedObjects, in addition to checking the "GatewayAPI" featuregate. Before this change, the operator could add istios to relatedObjects even if the OSSM subscription failed to install. By convention, an operator should only add resources to relatedObjects if those resources exist. This commit fixes OCPBUGS-54745. https://issues.redhat.com/browse/OCPBUGS-54745 * pkg/operator/controller/status/controller.go (gatewaysResourceName, gatewayclassesResourceName, istiosResourceName): New consts for the CRD names. (relatedObjectsCRDs): New var for a string set that contains gatewaysResourceName, gatewayclassesResourceName, and istiosResourceName. (New): Check the GatewayAPIControllerEnabled field in the controller config in addition to checking GatewayAPIEnabled to determine whether to watch subscriptions and customresourcedefinitions. Add a watch on customresourcedefinitions, with a predicate for CRDs with names that are in relatedObjectsCRDs. (Config): Add GatewayAPIControllerEnabled. (Reconcile): Check the GatewayAPIControllerEnabled field in the controller config as well as the haveIstiosResource, haveGatewayclassesResource, and haveGatewaysResource fields in the operatorState object, and conditionally add the corresponding resources to relatedObjects. (operatorState): Add haveIstiosResource, haveGatewaysResource, and haveGatewayclassesResource fields. (getOperatorState): Check GatewayAPIControllerEnabled in addition to GatewayAPIEnabled before checking for the OSSM subscription. Set haveGatewaysResource, haveGatewayclassesResource, and haveIstiosResource. * pkg/operator/operator.go (New): Specify GatewayAPIControllerEnabled in the status controller config. * test/e2e/operator_test.go (TestClusterOperatorStatusRelatedObjects): Expect to see "gateways" and "gatewayclasses" in relatedObjects if the "GatewayAPI" and "GatewayAPIController" featuregates are enabled.
Detect subscriptions that would prevent the Ingress Operator from installing OSSM 3, and set the operator's degraded condition to true when any of those subscriptions are present. This is the implementation of NE-2066
Cherry-picked from: 8a40966 openshift#1354 Conflicts resolved: - pkg/operator/operator.go: Added GatewayAPIWithoutOLM gate alongside existing 4.21 gates (GatewayAPI, GatewayAPIController, RouteExternalCertificate) - Note: Go tidy will fail in this commit since Aslak's development branch pulls in K8S dependencies that are too new - a future commit in this backport will vendor the official release resolve go.mod
Cherry-picked from: 5617a41 openshift#1354
gcs278
force-pushed
the
backport-noOLM-4.19
branch
from
e7428df to
6b41825
Compare
gcs278
changed the title
Cherry-picked from: ed2eb36 openshift#1354 Conflicts resolved: - pkg/operator/controller/status/controller.go: Took incoming noOLM logic (useOLM/useSailLibrary, conditional subscription listing) but wrapped in existing 4.19 GatewayAPIEnabled guard. Restored GatewayAPIControllerEnabled guard that was present in the original condition but dropped during cherry-pick.
…rRole Cherry-picked from: a758d83 openshift#1354
Cherry-picked from: 9c4d792 openshift#1354 Conflicts resolved: - test/e2e/gateway_api_test.go: Kept 4.21 gatewayAPIControllerEnabled guard, added gatewayAPIWithoutOLMEnabled conditionals inside it. Kept xcrdNames alongside new istioCRDNames. - Removed references to testGatewayAPIInfrastructureAnnotations, testGatewayAPIInternalLoadBalancer, and testGatewayOpenshiftConditions which were added in separate PRs not present on release-4.21.
Cherry-picked from: 955a5c0 openshift#1354
Cherry-picked from: 6d2c6c8 openshift#1402
Cherry-picked from: 43c978a openshift#1404 Conflicts resolved: - go.mod: Switched sail-operator replace from aslakknutsen's development fork to the official openshift-service-mesh/sail-operator v0.0.0-20260327145107 (OSSM 3.3.1). Added replace directives to pin k8s.io/api, apimachinery, apiextensions-apiserver, apiserver, client-go, component-base, kube-openapi, controller-runtime, gateway-api, and gnostic-models to their original 4.19 versions, preventing the sail-operator's transitive dependencies from bumping them. - vendor/: Re-vendored from scratch with pinned dependencies. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Cherry-picked from: b1bbbb7 openshift#1404
gcs278
force-pushed
the
backport-noOLM-4.19
branch
from
6b41825 to
82ca5a5
Compare
|
/test unit |
|
/test e2e-aws-operator |
|
@gcs278: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
4 participants
Summary
Backport of the noOLM / Sail Library installation path (NE-2286, shipped in 4.22) to release-4.19. Same pattern as 4.21 (PR #1442) and 4.20 (PR #1459). The primary driver is OCPBUGS-86778, which blocks all OSSM z-stream upgrades via OLM on 4.19-4.21, preventing CVE fixes from shipping.
This PR is intended to merge with the
GatewayAPIWithoutOLMfeature gate disabled, making it a no-op on merge. The goal is to subsequently enable the gate by default (via openshift/api) to activate the Sail Library path and resolve the OLM issues.Cherry-picked PRs
Prerequisites (4.19→4.20 changes the noOLM code depends on)
GatewayAPIControllerEnabledconfig field, ctx parameter togetOperatorState, relatedObjects namespace fixessubscriptionCache,ossmSubscriptionsconflict detection,compareVersionNums,GatewayAPIOperatorVersion,GatewayClassIndexFieldName,computeGatewayAPIInstallDegradedConditionMain noOLM PRs
istio_sail_installer.go,istio_olm.gorefactor,migration.go,status.go, CRD manifests, Sail Library RBAC manifestsNote: #1393 (OCPBUGS-79667: Use feature-gate annotation for Sail Library RBAC) was also a dependency but is being skipped because CVO on this release does not support the
release.openshift.io/feature-gateannotation (openshift/cluster-version-operator#1273 was not backported). As a result, the Sail Library RBAC manifests use therelease.openshift.io/feature-setannotation and a separate PR will be needed to remove this annotation before promoting the feature gate to GA.Versioning
This backport does not bump the Gateway API CRDs (remain at v1.3.0) or the Istio version (remains at v1.26.2). When the
GatewayAPIWithoutOLMfeature gate is enabled, the Sail Library will install Istio using the same v1.26.2 version that the OLM path currently uses.Dependency Pinning Approach
Same approach as the 4.20 backport (PR #1459). The sail-operator (OSSM 3.3.1) requires k8s 0.34 and controller-runtime 0.22, but its
pkg/installpackage only uses basic CRUD operations unchanged in older versions.k8s.io/apik8s.io/apimachineryk8s.io/client-gok8s.io/apiextensions-apiserverk8s.io/apiserverk8s.io/component-basek8s.io/kube-openapisigs.k8s.io/controller-runtimesigs.k8s.io/gateway-apigithub.com/google/gnostic-modelsRisk assessment: The sail-operator install package uses only stable controller-runtime interfaces (
client.ClientCRUD,pkg/log,pkg/scheme). No APIs from newer versions are used. Thestructured-merge-diff/v4vsv6incompatibility is avoided entirely.Conflicts resolved
go.mod: Kept 4.19 openshift/api fork replace, added sail-operator replace for aslakknutsen's dev branch (later switched to OSSM official in NE-2519 commit)pkg/operator/operator.go: AddedGatewayAPIWithoutOLMgate alongside existing 4.19 gates includingPrivateHostedZoneAWS(sharedVPCEnabled), which was removed in 4.20test/e2e/util_gatewayapi_test.go: Took incoming gateway condition checking and service status logginggo.mod/vendor/: Re-vendored with 4.19 dependency pinsMerge Order
release.openshift.io/feature-setannotation from Sail Library RBAC manifestsVerification
makebuilds successfully🤖 Generated with Claude Code