Bug 1873345: specify a serviceaccount in the deployment

[joelddiaz]

allow downgrading from 4.6 (where we do specify a serviceaccount)

[openshift-ci-robot]

@joelddiaz: No Bugzilla bug is referenced in the title of this pull request.
To reference a bug, add 'Bug XXX:' to the title of this pull request and request another bug refresh with /bugzilla refresh.

In response to this:

specify a serviceaccount in the deployment

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci-robot]

@joelddiaz: This pull request references Bugzilla bug 1868376, which is invalid:

• expected the bug to target the "4.5.z" release, but it targets "---" instead
• expected Bugzilla bug 1868376 to depend on a bug targeting a release in 4.6.0, 4.6.z and in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but no dependents were found

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Bug 1868376: specify a serviceaccount in the deployment

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[joelddiaz]

/hold

[joelddiaz]

@sdodson here's the proposed fix

[sdodson]

So this was something that defaulted in 4.5, they upgrade to 4.6 and it gets removed, downgrade to 4.5 and needs to be set explicitly on downgrade?

[joelddiaz]

@sdodson Yes. I built my own release image with this change, and was able to downgrade from 4.6 successfully (after fixing my typo in the original PR). The Deployment no longer references the serviceAccount that is new in 4.6, and instead references the default serviceAccount as was used pre-4.6.

  schedulerName: default-scheduler
  securityContext:
    fsGroup: 1000130000
    seLinuxOptions:
      level: s0:c11,c10
  serviceAccount: default
  serviceAccountName: default
  terminationGracePeriodSeconds: 10
  tolerations:
  - effect: NoSchedule
    key: node-role.kubernetes.io/master
    operator: Exists

It appears the CVO is not doing a full replace of the objects, but is merely patching them which is why we need to explicitly set the values so they get reverted on downgrade.

[joelddiaz]

/retest

[sdodson]

/lgtm

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: joelddiaz, sdodson

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [joelddiaz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sdodson]

/retitle Bug 1873345: specify a serviceaccount in the deployment

[openshift-ci-robot]

@joelddiaz: This pull request references Bugzilla bug 1873345, which is invalid:

• expected dependent Bugzilla bug 1868376 to be in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but it is MODIFIED instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Bug 1873345: specify a serviceaccount in the deployment

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[sdodson]

I've overridden bugzilla/valid-bug because this bug only happens when downgrading from 4.6 to 4.5, so while QE shall test that we've not regressed in 4.6 there's no code changes to be made on that branch and this bug was marked as a TestBlocker.

[sdodson]

/refresh

[joelddiaz]

/unhold

[openshift-ci-robot]

@joelddiaz: All pull requests linked via external trackers have merged:

• openshift/cloud-credential-operator#240

Bugzilla bug 1873345 has been moved to the MODIFIED state.

In response to this:

Bug 1873345: specify a serviceaccount in the deployment

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.