Use recert for proxy seed reconfiguration #410

omertuc · 2024-03-25T10:09:23Z

Overview

LCA will now use recert's new proxy feature. This will allow us to
support environments where the seed proxy is different than the upgraded
cluster's proxy. It will also allow us to perform a rollout-free seed
proxy reconfiguration.

Clusters with a proxy can only be upgraded using seeds that have a
proxy. Clusters without a proxy can only be upgraded using seeds that
don't have a proxy.

Notes

Two new fields have been added to SeedReconfiguration, Proxy and
StatusProxy - see commit diff for an explanation of why we need both
and how they're determined in every scenario.

Added a new HasProxy field to the seed cluster info struct.

Seed images will now contain a com.openshift.lifecycle-agent.seed_cluster_info
OCI label which will contain a JSON serialized seed cluster info struct.
This label will allow LCA (and maybe IBIO in the future?) to make
informed decisions about the compatibility of a particular seed image
with the cluster being upgraded. For example, LCA will refuse to upgrade
a cluster that has a proxy with a seed that doesn't. This label helps
LCA knows whether the seed has a proxy or not (through the new
HasProxy field), and block the upgrade appropriately before the image
even gets pulled.

openshift-ci · 2024-03-25T10:09:27Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

donpenney · 2024-03-26T14:02:18Z

controllers/prep_handlers.go

 	if !ok {
 		return fmt.Errorf(
-			"seed image %s is missing the %s label, please build a new image using the latest version of the lca-cli",
-			seedImageRef, common.SeedFormatOCILabel)
+			"seed image is missing the %s label, please build a new image using the latest version of the lca-cli",


Not necessarily "latest version", but seed was generated from "incompatible version of LCA" maybe?

I agree, but unrelated to PR. Created #423

donpenney · 2024-03-26T14:05:09Z

lca-cli/seedcreator/seedcreator.go

+	}
+
+	clusterInfoJSON := string(clusterInfoJSONSBytes)
+	if err := s.createAndPushSeedImage(clusterInfoJSON); err != nil {


Do we really want all this in a label? Why not just validate the data from the manifest.json after pulling the image? I get that it would save the pull, but is there some other benefit?

That said, I do like the idea of this being an easy way to access the manifest.json data without pulling the image, for expanded image validation. Are there any cons to it? Like would we end up with restrictions on what could get added to the manifest.json? I think no, but I'm not sure

Yeah exactly, it's nice to have. Couldn't think of any cons. It's information that's already in the seed, just now duplicated to different location as well (previously just a file inside a layer, now also in the manifest), so I don't see any additional compatibility restrictions this would add.

Like would we end up with restrictions on what could get added to the manifest.json?

Perhaps in terms of size. I guess at that point in the future where we need something huge in there, it would be an obvious problem and we could redact that huge thing we put in manifest.json before we serialize it to put inside the label

leo8a · 2024-04-02T09:18:03Z

/retest

leo8a

overall this looks great to me, thanks for adding it

controllers/prep_handlers.go

internal/clusterconfig/clusterconfig.go

leo8a · 2024-04-02T13:40:37Z

/lgtm

api/seedreconfig/seedreconfig.go

omertuc · 2024-04-02T16:52:05Z

/test ibu-e2e-flow

omertuc · 2024-04-04T10:23:08Z

/test ibu-e2e-flow

omertuc · 2024-04-04T13:49:57Z

/test ibu-e2e-flow

api/seedreconfig/seedreconfig.go

controllers/prep_handlers.go

omertuc · 2024-04-11T20:08:38Z

/test ibu-e2e-flow

omertuc · 2024-04-12T14:18:22Z

/test ibu-e2e-flow

omertuc · 2024-04-15T07:27:15Z

/remove-label cluster-config-api-changed

# Overview LCA will now use recert's new proxy feature. This will allow us to support environments where the seed proxy is different than the upgraded cluster's proxy. It will also allow us to perform a rollout-free seed proxy reconfiguration. Clusters with a proxy can only be upgraded using seeds that have a proxy. Clusters without a proxy can only be upgraded using seeds that don't have a proxy. # Notes Two new fields have been added to `SeedReconfiguration`, `Proxy` and `StatusProxy` - see commit diff for an explanation of why we need both and how they're determined in every scenario. Added a new `HasProxy` field to the seed cluster info struct. Seed images will now contain a `com.openshift.lifecycle-agent.seed_cluster_info` OCI label which will contain a JSON serialized seed cluster info struct. This label will allow LCA (and maybe IBIO in the future?) to make informed decisions about the compatibility of a particular seed image with the cluster being upgraded. For example, LCA will refuse to upgrade a cluster that has a proxy with a seed that doesn't. This label helps LCA knows whether the seed has a proxy or not (through the new `HasProxy` field), and block the upgrade appropriately before the image even gets pulled. # install-config On top of proxy, we're also going to be using recert's new install-config option. See comment about the new InstallConfig field in the seed reconfiguration struct for more information about why.

omertuc · 2024-04-15T07:55:48Z

/remove-label cluster-config-api-changed

omertuc · 2024-04-15T07:56:00Z

/test ibu-e2e-flow

donpenney

/lgtm

omertuc · 2024-04-15T12:20:50Z

/approve

openshift-ci · 2024-04-15T12:20:58Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: omertuc

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [omertuc]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 25, 2024

openshift-ci bot added the cluster-config-api-changed Cluster config API changed. It's used by other projects. Review to ensure your change is nonbreaking label Mar 25, 2024

omertuc force-pushed the proxy branch 2 times, most recently from d51fb0c to 9f3b439 Compare March 25, 2024 14:23

donpenney reviewed Mar 26, 2024

View reviewed changes

omertuc mentioned this pull request Mar 27, 2024

Missing label phrasing #423

Open

omertuc marked this pull request as ready for review March 27, 2024 18:59

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 27, 2024

openshift-ci bot requested review from donpenney and leo8a March 27, 2024 18:59

leo8a reviewed Apr 2, 2024

View reviewed changes

controllers/prep_handlers.go Outdated Show resolved Hide resolved

controllers/prep_handlers.go Show resolved Hide resolved

internal/clusterconfig/clusterconfig.go Outdated Show resolved Hide resolved

omertuc force-pushed the proxy branch 2 times, most recently from 7baeb49 to fc48508 Compare April 2, 2024 13:13

openshift-ci bot assigned leo8a Apr 2, 2024

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Apr 2, 2024

tsorya reviewed Apr 2, 2024

View reviewed changes

api/seedreconfig/seedreconfig.go Show resolved Hide resolved

omertuc mentioned this pull request Apr 4, 2024

Forward v0 to main rh-ecosystem-edge/recert#124

Merged

eranco74 reviewed Apr 4, 2024

View reviewed changes

api/seedreconfig/seedreconfig.go Show resolved Hide resolved

controllers/prep_handlers.go Show resolved Hide resolved

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Apr 11, 2024

omertuc force-pushed the proxy branch from fc48508 to 9020fe0 Compare April 11, 2024 20:17

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Apr 11, 2024

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Apr 11, 2024

omertuc force-pushed the proxy branch from 9020fe0 to 6a1a167 Compare April 11, 2024 20:18

omertuc force-pushed the proxy branch from 6a1a167 to 7f2f4de Compare April 12, 2024 13:04

openshift-ci bot removed the cluster-config-api-changed Cluster config API changed. It's used by other projects. Review to ensure your change is nonbreaking label Apr 15, 2024

omertuc force-pushed the proxy branch from 7f2f4de to 250e53f Compare April 15, 2024 07:29

openshift-ci bot added the cluster-config-api-changed Cluster config API changed. It's used by other projects. Review to ensure your change is nonbreaking label Apr 15, 2024

openshift-ci bot removed the cluster-config-api-changed Cluster config API changed. It's used by other projects. Review to ensure your change is nonbreaking label Apr 15, 2024

donpenney reviewed Apr 15, 2024

View reviewed changes

openshift-ci bot assigned donpenney Apr 15, 2024

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Apr 15, 2024

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 15, 2024

openshift-merge-bot bot merged commit 0cf7fed into openshift-kni:main Apr 15, 2024
7 checks passed

eranco74 mentioned this pull request Apr 18, 2024

MGMT-16610: Add Proxy config option openshift/image-based-install-operator#47

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use recert for proxy seed reconfiguration #410

Use recert for proxy seed reconfiguration #410

omertuc commented Mar 25, 2024

openshift-ci bot commented Mar 25, 2024

donpenney Mar 26, 2024

omertuc Mar 27, 2024

donpenney Mar 26, 2024

donpenney Mar 26, 2024

omertuc Mar 27, 2024 •

edited

Loading

leo8a commented Apr 2, 2024

leo8a left a comment

leo8a commented Apr 2, 2024

omertuc commented Apr 2, 2024

omertuc commented Apr 4, 2024

omertuc commented Apr 4, 2024

omertuc commented Apr 11, 2024

omertuc commented Apr 12, 2024

omertuc commented Apr 15, 2024

omertuc commented Apr 15, 2024

omertuc commented Apr 15, 2024

donpenney left a comment

omertuc commented Apr 15, 2024

openshift-ci bot commented Apr 15, 2024

Use recert for proxy seed reconfiguration #410

Use recert for proxy seed reconfiguration #410

Conversation

omertuc commented Mar 25, 2024

Overview

Notes

openshift-ci bot commented Mar 25, 2024

donpenney Mar 26, 2024

Choose a reason for hiding this comment

omertuc Mar 27, 2024

Choose a reason for hiding this comment

donpenney Mar 26, 2024

Choose a reason for hiding this comment

donpenney Mar 26, 2024

Choose a reason for hiding this comment

omertuc Mar 27, 2024 • edited Loading

Choose a reason for hiding this comment

leo8a commented Apr 2, 2024

leo8a left a comment

Choose a reason for hiding this comment

leo8a commented Apr 2, 2024

omertuc commented Apr 2, 2024

omertuc commented Apr 4, 2024

omertuc commented Apr 4, 2024

omertuc commented Apr 11, 2024

omertuc commented Apr 12, 2024

omertuc commented Apr 15, 2024

omertuc commented Apr 15, 2024

omertuc commented Apr 15, 2024

donpenney left a comment

Choose a reason for hiding this comment

omertuc commented Apr 15, 2024

openshift-ci bot commented Apr 15, 2024

omertuc Mar 27, 2024 •

edited

Loading