Rename ClusterRoles created by OperatorGroups#3035
Merged
tmshort merged 2 commits intooperator-framework:masterfrom Sep 20, 2023
Merged
Rename ClusterRoles created by OperatorGroups#3035tmshort merged 2 commits intooperator-framework:masterfrom
tmshort merged 2 commits intooperator-framework:masterfrom
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: tmshort The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
Contributor
Author
|
Update of #2991 |
Contributor
Author
|
/hold Until we have plans for cleanup, and if anything will be backported. |
openshift-ci
Bot
added
the
do-not-merge/hold
Contributor
Author
|
/retest |
| "": { | ||
| &rbacv1.ClusterRole{ | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| ResourceVersion: "", |
Contributor
There was a problem hiding this comment.
nit: can remove these empty fields
| } | ||
| if err != nil { | ||
| return fmt.Errorf("namespace: %v, error: %v", namespace, err) | ||
| if apierrors.IsNotFound(err) { |
Contributor
There was a problem hiding this comment.
What's the meaning of this change?
Contributor
Author
There was a problem hiding this comment.
It was in @perdasilva's change that I pulled in directly. Line numbers are probably a bit different due to reverting format-only changes.
Looks as though it's trying to avoid double-wrapping the error.
Contributor
|
Content looks good, just nits. /lgtm |
openshift-ci
Bot
added
lgtm
tmshort
force-pushed
the
PR-2991-new
branch
from
540da95 to
58050e1
Compare
Contributor
|
/lgtm |
tmshort
force-pushed
the
PR-2991-new
branch
from
58050e1 to
88725b8
Compare
Contributor
Author
|
/unhold |
openshift-ci
Bot
removed
the
do-not-merge/hold
Contributor
|
/lgtm |
When an OperatorGroup creates a ClusterRole, it's based directly on the OG name with a suffix, this causes two issues: 1. same-named OGs in different namespaces overwrite each others CRs 2. there are some very important CRs that could be overwritten by OG Tests added. Signed-off-by: Per Goncalves da Silva <pegoncal@redhat.com> Signed-off-by: Todd Short <todd.short@me.com>
Signed-off-by: Todd Short <todd.short@me.com>
tmshort
force-pushed
the
PR-2991-new
branch
from
88725b8 to
94f840b
Compare
Contributor
|
/lgtm |
11 tasks
11 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of the change:
When an OperatorGroup creates a ClusterRole, it's based directly on the OG name with a suffix, this causes two issues:
Tests added.
Motivation for the change:
The ClusterRoles created by an OperatorGroup can conflict with existing CRs and with CRs created by OGs.
Architectural changes:
Naming of these OG CRs change, but since they're aggregated, admins shouldn't really be using them, so the new names shouldn't matter.
There will be a need to clean up the old roles, but that could potentially be dangerous.
Testing remarks:
Reviewer Checklist
/doc[FLAKE]are truly flaky and have an issue