OCPBUGS-14922: skip console-plugin installation if console capability…

… is disabled

This PR fixes the failure to upgrade from OpenShift version 4.13 to
4.14 in environments (such as telco) where `console` capability is
disabled. The upgrade fails  when CMO executes the console-plugin task
which fails due to missing ConsolePlugin CRD.

The fix checks if `console` capability is enabled in ClusterVersion -
version and bails out (with a log message) if it is disabled.

Signed-off-by: Sunil Thaha <sthaha@redhat.com>

jsonnet/components/cluster-monitoring-operator.libsonnet

@@ -181,7 +181,7 @@ function(params) {
       {
         apiGroups: ['config.openshift.io'],
         resources: ['clusterversions'],
-        verbs: ['get'],
+        verbs: ['get', 'list', 'watch'],
       },
       {
         apiGroups: ['config.openshift.io'],

manifests/0000_50_cluster-monitoring-operator_02-role.yaml

@@ -78,6 +78,8 @@ rules:
   - clusterversions
   verbs:
   - get
+  - list
+  - watch
 - apiGroups:
   - config.openshift.io
   resources:

pkg/client/client.go

@@ -377,6 +377,25 @@ func (c *Client) ConsoleListWatch(ctx context.Context) *cache.ListWatch {
 	}
 }
 
+func (c *Client) ClusterVersionListWatch(ctx context.Context, name string) *cache.ListWatch {
+	clusterVersionInterface := c.oscclient.ConfigV1().ClusterVersions()
+
+	return &cache.ListWatch{
+		ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			return clusterVersionInterface.List(ctx,
+				metav1.ListOptions{
+					FieldSelector: fields.OneTermEqualSelector("metadata.name", name).String(),
+				})
+		},
+		WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			return clusterVersionInterface.Watch(ctx,
+				metav1.ListOptions{
+					FieldSelector: fields.OneTermEqualSelector("metadata.name", name).String(),
+				})
+		},
+	}
+}
+
 func (c *Client) ClusterOperatorListWatch(ctx context.Context, name string) *cache.ListWatch {
 	ClusterOperatorInterface := c.oscclient.ConfigV1().ClusterOperators()
 
@@ -1862,6 +1881,19 @@ func (c *Client) PodCapacity(ctx context.Context) (int, error) {
 	return int(podCapacityTotal), nil
 }
 
+func (c *Client) HasClusterCapability(ctx context.Context, capability configv1.ClusterVersionCapability) (bool, error) {
+	version, err := c.oscclient.ConfigV1().ClusterVersions().Get(ctx, "version", metav1.GetOptions{})
+	if err != nil {
+		return false, err
+	}
+
+	return slices.Contains(version.Status.Capabilities.EnabledCapabilities, capability), nil
+}
+
+func (c *Client) HasConsoleCapability(ctx context.Context) (bool, error) {
+	return c.HasClusterCapability(ctx, configv1.ClusterVersionCapabilityConsole)
+}
+
 func (c *Client) CreateOrUpdateConsolePlugin(ctx context.Context, plg *consolev1.ConsolePlugin) error {
 	conClient := c.osconclient.ConsoleV1().ConsolePlugins()
 	existing, err := conClient.Get(ctx, plg.GetName(), metav1.GetOptions{})

pkg/operator/operator.go

@@ -406,6 +406,20 @@ func New(
 	}
 	o.informers = append(o.informers, informer)
 
+	// Many of the cluster capabilities such as Console can be enabled after
+	// installation. So this watches for any updates to the ClusterVersion - version
+	informer = cache.NewSharedIndexInformer(
+		o.client.ClusterVersionListWatch(ctx, "version"),
+		&configv1.ClusterVersion{}, resyncPeriod, cache.Indexers{},
+	)
+	_, err = informer.AddEventHandler(cache.ResourceEventHandlerFuncs{
+		UpdateFunc: func(_, newObj interface{}) { o.handleEvent(newObj) },
+	})
+	if err != nil {
+		return nil, err
+	}
+	o.informers = append(o.informers, informer)
+
 	// Setup PVC informers to sync annotation updates.
 	for _, ns := range []string{o.namespace, o.namespaceUserWorkload} {
 		informer = cache.NewSharedIndexInformer(
@@ -595,6 +609,12 @@ func (o *Operator) handleEvent(obj interface{}) {
 		return
 	}
 
+	if _, ok := obj.(*configv1.ClusterVersion); ok {
+		klog.Info("Triggering update due to a clusterversion update")
+		o.enqueue(cmoConfigMap)
+		return
+	}
+
 	key, ok := o.keyFunc(obj)
 	if !ok {
 		return

pkg/tasks/monitoring_plugin.go

@@ -20,6 +20,7 @@ import (
 	"github.com/openshift/cluster-monitoring-operator/pkg/client"
 	"github.com/openshift/cluster-monitoring-operator/pkg/manifests"
 	"github.com/pkg/errors"
+	"k8s.io/klog/v2"
 )
 
 type MonitoringPluginTask struct {
@@ -37,6 +38,22 @@ func NewMonitoringPluginTask(client *client.Client, factory *manifests.Factory,
 }
 
 func (t *MonitoringPluginTask) Run(ctx context.Context) error {
+	// NOTE:  console capability (like other capabilities) can only go from
+	// disabled -> enabled and not the other way around, meaning that CMO
+	// doesn't have to deal with removal of the console plugin resources.
+	// Hence, skip installing console if console capability is disabled.
+	{
+		enabled, err := t.client.HasConsoleCapability(ctx)
+		if err != nil {
+			return errors.Wrap(err, "failed to determine if console capability is enabled")
+		}
+
+		if !enabled {
+			klog.V(4).Infof("Skipping installation of Console Plugin as console capability is disabled")
+			return nil
+		}
+	}
+
 	{ // plugin
 		plg, err := t.factory.MonitoringPlugin()
 		if err != nil {