Bug 1756454: Separate upgrade flags for safety instead of abusing force #111
Conversation
|
@smarterclayton: No Bugzilla bug is referenced in the title of this pull request. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
openshift-ci-robot
added
size/M
smarterclayton
changed the title
|
@smarterclayton: This pull request references Bugzilla bug 1756454, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
openshift-ci-robot
added
the
bugzilla/invalid-bug
smarterclayton
changed the title
smarterclayton
force-pushed
the
upgrade_42
branch
from
e10f667 to
8305f21
Compare
|
There also this bug https://bugzilla.redhat.com/show_bug.cgi?id=1713263 that states that |
The --force flag is dangerous and potentially allows untrusted content to be upgraded to accidentally. Instead, introduce two new flags `--allow-explicit-upgrade` (for upgrading to something not in availableVersions) and `--allow-upgrade-with-warnigns` (for upgrading when another upgrade is in progress or the cluster is reporting an error) and remove those checks from `--force`. While this is an API change, it is necessary to ensure that users do not accidentally get access to untrusted content when performing upgrades across major versions in advance of graph updates, or when they are upgrading in disconnected environments.
smarterclayton
force-pushed
the
upgrade_42
branch
from
8305f21 to
772f7a4
Compare
|
/retest |
|
/bugzilla refresh |
|
@smarterclayton: This pull request references Bugzilla bug 1756454, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/lgtm |
jwforres
added
the
cherry-pick-approved
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jwforres, smarterclayton The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Given the state of CI on master and today's deadline, and that manual testing has been done to verify this on 4.2, overriding bugzilla bot. |
jwforres
added
bugzilla/valid-bug
|
@smarterclayton: All pull requests linked via external trackers have merged. Bugzilla bug 1756454 has been moved to the MODIFIED state. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
5 participants
The --force flag is dangerous and potentially allows untrusted
content to be upgraded to accidentally. Instead, introduce two
new flags
--allow-explicit-upgrade(for upgrading to something notin availableVersions) and
--allow-unsafe-upgrade(for upgradingwhen another upgrade is in progress or the cluster is reporting
an error) and remove those checks from
--force.While this is an API change, it is necessary to ensure that users
do not accidentally get access to untrusted content when
performing upgrades across major versions in advance of graph
updates, or when they are upgrading in disconnected environments.
Backport of #109