AGENT-1412: Prevent deletion of InternalReleaseImage when in use by bfournie · Pull Request #5545 · openshift/machine-config-operator

bfournie · 2026-01-12T16:47:39Z

Add ValidatingAdmissionPolicy to block deletion of the InternalReleaseImage singleton resource if any of its release bundles are currently in use by the cluster. This prevents accidental deletion of IRI while the cluster is running a release version that is stored in the InternalReleaseImage resource.

The policy checks the ClusterVersion's current version against all release bundle names in the IRI status. If a match is found, deletion is blocked with a clear error message instructing the user to upgrade or downgrade before deletion.

This is part of the NoRegistryClusterInstall feature, where deletion of IRI is the default opt-out mechanism, and this guard ensures safe operation.

🤖 Generated with Claude Code

- What I did

- How to verify it

- Description for the changelog

openshift-ci-robot · 2026-01-12T16:47:44Z

@bfournie: This pull request references AGENT-1412 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Add ValidatingAdmissionPolicy to block deletion of the InternalReleaseImage singleton resource if any of its release bundles are currently in use by the cluster. This prevents accidental deletion of IRI while the cluster is running a release version that is stored in the InternalReleaseImage resource.

The policy checks the ClusterVersion's current version against all release bundle names in the IRI status. If a match is found, deletion is blocked with a clear error message instructing the user to upgrade or downgrade before deletion.

This is part of the NoRegistryClusterInstall feature, where deletion of IRI is the default opt-out mechanism, and this guard ensures safe operation.

🤖 Generated with Claude Code

- What I did

- How to verify it

- Description for the changelog

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

bfournie · 2026-01-12T21:11:56Z

/hold

bfournie · 2026-01-14T18:09:36Z

/unhold

andfasano · 2026-01-19T09:22:09Z

+	klog.V(4).Infof("Initializing status for InternalReleaseImage %s", iri.Name)
+
+	// Get the release payload image from ClusterVersion
+	releaseImage, err := osimagestream.GetReleasePayloadImage(ctrl.clusterVersionLister)


I have a small concern about the specific dependency. The GetReleasePayloadImage function it's a perfect match here and it avoids a logical duplication, but it is placed into the osimagestream package, meant to be used by a different operator. I'd feel more confident to have it into a more "neutral" package, to avoid unwanted side effects / dependencies. @pablintino wdyt?

Good point. I could move the function to pkg/controller/common/helpers.go or create pkg/controller/common/clusterversion.go but it would of course cause some osimagestream changes. Interested to hear @pablintino thoughts.

Agree with both of you, but for now I think it's ok. If we change the function we will see it's used here and patch it as needed.

andfasano · 2026-01-21T14:01:42Z

/lgtm

bfournie · 2026-01-21T16:30:48Z

/verified later @mhanss

openshift-ci-robot · 2026-01-21T16:31:02Z

@bfournie: This PR has been marked to be verified later by @mhanss.

Details

In response to this:

/verified later @mhanss

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

bfournie · 2026-01-21T23:18:23Z

/verified later @mhanss

openshift-ci-robot · 2026-01-21T23:18:36Z

@bfournie: This PR has been marked to be verified later by @mhanss.

Details

In response to this:

/verified later @mhanss

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

pablintino

/lgtm

pablintino · 2026-01-22T13:04:12Z

+	if optr.fgHandler.Enabled(features.FeatureGateNoRegistryClusterInstall) {
+		// Only deploy the IRI deletion guard policy if the IRI resource actually exists
+		if optr.iriLister != nil {
+			if _, err := optr.iriLister.Get(ctrlcommon.InternalReleaseImageInstanceName); err == nil {


Nit: Doesn't require such level of nesting, but I'm ok.

pablintino · 2026-01-22T13:05:59Z

+	klog.V(4).Infof("Initializing status for InternalReleaseImage %s", iri.Name)
+
+	// Get the release payload image from ClusterVersion
+	releaseImage, err := osimagestream.GetReleasePayloadImage(ctrl.clusterVersionLister)


Agree with both of you, but for now I think it's ok. If we change the function we will see it's used here and patch it as needed.

bfournie · 2026-01-22T13:46:09Z

/retest-required

openshift-ci-robot · 2026-01-22T16:02:01Z

/retest-required

Remaining retests: 0 against base HEAD 6678a5f and 2 for PR HEAD 38b9bce in total

openshift-ci-robot · 2026-01-22T19:01:26Z

/retest-required

Remaining retests: 0 against base HEAD 4c02195 and 1 for PR HEAD 38b9bce in total

Add ValidatingAdmissionPolicy to block deletion of the InternalReleaseImage singleton resource if any of its release bundles are currently in use by the cluster. This prevents accidental deletion of IRI while the cluster is running a release version that is stored in the InternalReleaseImage resource. The policy checks the ClusterVersion's current version against all release bundle names in the IRI status. If a match is found, deletion is blocked with a clear error message instructing the user to upgrade or downgrade before deletion. This is part of the NoRegistryClusterInstall feature, where deletion of IRI is the default opt-out mechanism, and this guard ensures safe operation. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

andfasano · 2026-01-23T08:06:50Z

/lgtm

openshift-ci · 2026-01-23T08:07:12Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: andfasano, bfournie, pablintino

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [pablintino]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

bfournie · 2026-01-23T11:31:24Z

/verified later @mhanss

openshift-ci-robot · 2026-01-23T11:31:38Z

@bfournie: This PR has been marked to be verified later by @mhanss.

Details

In response to this:

/verified later @mhanss

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

bfournie · 2026-01-23T11:32:11Z

/retest-required

openshift-ci · 2026-01-23T11:55:13Z

@bfournie: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-gcp-op-ocl	`22a856f`	link	false	`/test e2e-gcp-op-ocl`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

This adds the minimal osimagestream.GetReleasePayloadImage() function needed to support PR openshift#5545 (AGENT-1412 IRI deletion guard) without requiring the full OSImageStream functionality from PR openshift#5476. This is a targeted backport to release-4.21 to enable the IRI deletion guard feature. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

…on-guard AGENT-1412: Prevent deletion of InternalReleaseImage when in use Add ValidatingAdmissionPolicy to block deletion of the InternalReleaseImage singleton resource if any of its release bundles are currently in use by the cluster. This prevents accidental deletion of IRI while the cluster is running a release version that is stored in the InternalReleaseImage resource. The policy checks the ClusterVersion's current version against all release bundle names in the IRI status. If a match is found, deletion is blocked with a clear error message instructing the user to upgrade or downgrade before deletion. This is part of the NoRegistryClusterInstall feature, where deletion of IRI is the default opt-out mechanism, and this guard ensures safe operation. Backported from upstream main with minimal osimagestream package support.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jan 12, 2026

openshift-ci Bot requested review from cheesesashimi and umohnani8 January 12, 2026 16:48

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 12, 2026

bfournie force-pushed the AGENT-1412-iri-deletion-guard branch from bc6d0a1 to eeb9859 Compare January 12, 2026 21:08

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 12, 2026

bfournie changed the title ~~DNM: AGENT-1412: Prevent deletion of InternalReleaseImage when in use~~ AGENT-1412: Prevent deletion of InternalReleaseImage when in use Jan 12, 2026

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jan 12, 2026

pablintino reviewed Jan 14, 2026

View reviewed changes

Comment thread ...s/machineconfigcontroller/internalreleaseimage-deletion-guard-validatingadmissionpolicy.yaml Outdated

pablintino reviewed Jan 14, 2026

View reviewed changes

Comment thread pkg/operator/sync.go Outdated

bfournie force-pushed the AGENT-1412-iri-deletion-guard branch 2 times, most recently from bf8d067 to 7d2d90b Compare January 14, 2026 18:07

openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jan 14, 2026

bfournie force-pushed the AGENT-1412-iri-deletion-guard branch from 7d2d90b to 5468d18 Compare January 14, 2026 20:29

andfasano reviewed Jan 19, 2026

View reviewed changes

bfournie force-pushed the AGENT-1412-iri-deletion-guard branch 4 times, most recently from b51a236 to da40da5 Compare January 20, 2026 16:00

openshift-ci Bot assigned andfasano Jan 21, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jan 21, 2026

openshift-ci-robot added verified-later verified Signifies that the PR passed pre-merge verification criteria labels Jan 21, 2026

pablintino reviewed Jan 21, 2026

View reviewed changes

Comment thread pkg/controller/internalreleaseimage/internalreleaseimage_controller.go

openshift-ci-robot added verified-later verified Signifies that the PR passed pre-merge verification criteria labels Jan 21, 2026

pablintino reviewed Jan 22, 2026

View reviewed changes

openshift-ci Bot assigned pablintino Jan 22, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 22, 2026

bfournie force-pushed the AGENT-1412-iri-deletion-guard branch from 38b9bce to 22a856f Compare January 23, 2026 00:17

openshift-ci-robot removed the verified Signifies that the PR passed pre-merge verification criteria label Jan 23, 2026

openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Jan 23, 2026

openshift-ci-robot removed the verified-later label Jan 23, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jan 23, 2026

openshift-ci-robot added verified-later verified Signifies that the PR passed pre-merge verification criteria labels Jan 23, 2026

openshift-merge-bot Bot merged commit aa07462 into openshift:main Jan 23, 2026
14 of 15 checks passed

bfournie deleted the AGENT-1412-iri-deletion-guard branch January 23, 2026 12:08

bfournie mentioned this pull request Jan 29, 2026

AGENT-1431: Backport InternalReleaseImage support #5610

Merged

Conversation

bfournie commented Jan 12, 2026

Uh oh!

openshift-ci-robot commented Jan 12, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bfournie commented Jan 12, 2026

Uh oh!

Uh oh!

Uh oh!

bfournie commented Jan 14, 2026

Uh oh!

Uh oh!

Uh oh!

andfasano Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

bfournie Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

pablintino Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

andfasano commented Jan 21, 2026

Uh oh!

bfournie commented Jan 21, 2026

Uh oh!

openshift-ci-robot commented Jan 21, 2026

Uh oh!

Uh oh!

bfournie commented Jan 21, 2026

Uh oh!

openshift-ci-robot commented Jan 21, 2026

Uh oh!

pablintino left a comment

Choose a reason for hiding this comment

Uh oh!

pablintino Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

pablintino Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

bfournie commented Jan 22, 2026

Uh oh!

openshift-ci-robot commented Jan 22, 2026

Uh oh!

openshift-ci-robot commented Jan 22, 2026

Uh oh!

andfasano commented Jan 23, 2026

Uh oh!

openshift-ci Bot commented Jan 23, 2026

Uh oh!

bfournie commented Jan 23, 2026

Uh oh!

openshift-ci-robot commented Jan 23, 2026

Uh oh!

bfournie commented Jan 23, 2026

Uh oh!

openshift-ci Bot commented Jan 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

openshift-ci-robot commented Jan 12, 2026 •

edited by openshift-ci Bot

Loading