OCPBUGS-32739: MachineConfigurations is only effective with name <cluster>

[djoshy]

This adds a new ValidatingAdmissionPolicy which rejects all MachineConfiguration objects not named "cluster".

How to test:

• Launch a cluster in TechPreview. Handy cluster bot command:

launch 4.16,openshift/machine-config-operator#4332 gcp,techpreview

If starting from default and transitioning to TechPreview, wait for the kube-apiserver operator to settle as this indicates that all the feature gates have been setup correctly. This can take up to 20 minutes, so I recommend the above method.

• Attempt to create a new CR of the type MachineConfiguration not named "cluster". Here is a sample object.

apiVersion: operator.openshift.io/v1
kind: MachineConfiguration
metadata:
  name: example-file
  namespace: openshift-machine-config-operator
spec:
  nodeDisruptionPolicy:
    files:
      - path: "/etc/example.sh"
        actions:
          - type: None

This should fail, with a message like this:

The machineconfigurations "example-file" is invalid: : ValidatingAdmissionPolicy 'machine-configuration-guards' with binding 'machine-configuration-guards-binding' denied request: Only a single object of MachineConfiguration is allowed and it must be named cluster.

This should be true for any object not named "cluster", regardless of the content.

• Now, rename the object you were trying to apply to "cluster", and try to apply it.

apiVersion: operator.openshift.io/v1
kind: MachineConfiguration
metadata:
  name: cluster
  namespace: openshift-machine-config-operator
spec:
  nodeDisruptionPolicy:
    files:
      - path: "/etc/example.sh"
        actions:
          - type: None

It should succeed:

machineconfiguration.operator.openshift.io/cluster configured

[openshift-ci-robot]

@djoshy: This pull request references Jira Issue OCPBUGS-32739, which is invalid:

• expected the bug to target the "4.16.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[djoshy]

/retest-required

[djoshy]

/jira refresh

[openshift-ci-robot]

@djoshy: This pull request references Jira Issue OCPBUGS-32739, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.16.0) matches configured target version for branch (4.16.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @sergiordlr

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[dkhater-redhat]

everything looks good to me! great work david :)

[djoshy]

/hold
for QE review

[dkhater-redhat]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: djoshy, dkhater-redhat

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [djoshy,dkhater-redhat]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[djoshy]

/test e2e-hypershift

[openshift-ci]

@djoshy: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-azure-ovn-upgrade-out-of-change	ff14562	link	false	/test e2e-azure-ovn-upgrade-out-of-change
ci/prow/okd-scos-e2e-aws-ovn	ff14562	link	false	/test okd-scos-e2e-aws-ovn

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[rioliu-rh]

check validatingadmissionpolicy

$ oc get validatingadmissionpolicy machine-configuration-guards -o yaml
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingAdmissionPolicy
metadata:
  creationTimestamp: "2024-04-28T01:41:01Z"
  generation: 1
  name: machine-configuration-guards
  resourceVersion: "11562"
  uid: 1e30604b-b2a9-424f-9052-f6b9defd7565
spec:
  failurePolicy: Fail
  matchConstraints:
    matchPolicy: Equivalent
    namespaceSelector: {}
    objectSelector: {}
    resourceRules:
    - apiGroups:
      - operator.openshift.io
      apiVersions:
      - v1
      operations:
      - CREATE
      - UPDATE
      resources:
      - machineconfigurations
      scope: '*'
  validations:
  - expression: object.metadata.name=='cluster'
    message: Only a single object of MachineConfiguration is allowed and it must be
      named cluster.
status:
  observedGeneration: 1
  typeChecking: {}

create a new machineconfiguration.operator.openshift.io with non-default name

$ cat create_mcfgs_with_non_default_name.yaml
apiVersion: operator.openshift.io/v1
kind: MachineConfiguration
metadata:
  name: myconfigs
  namespace: openshift-machine-config-operator
spec:
  nodeDisruptionPolicy:
    files:
      - path: /etc/test
        actions:
           - type: None

$ oc create -f create_mcfgs_with_non_default_name.yaml
The machineconfigurations "myconfigs" is invalid: : ValidatingAdmissionPolicy 'machine-configuration-guards' with binding 'machine-configuration-guards-binding' denied request: Only a single object of MachineConfiguration is allowed and it must be named cluster.

$ oc apply -f create_mcfgs_with_non_default_name.yaml
The machineconfigurations "myconfigs" is invalid: : ValidatingAdmissionPolicy 'machine-configuration-guards' with binding 'machine-configuration-guards-binding' denied request: Only a single object of MachineConfiguration is allowed and it must be named cluster.

update machineconfiguration.operator.openshift.io/cluster to make sure it can be updated w/o any issue

$ cat file_action_none.yaml
apiVersion: operator.openshift.io/v1
kind: MachineConfiguration
metadata:
  name: cluster
  namespace: openshift-machine-config-operator
spec:
  nodeDisruptionPolicy:
    files:
      - path: /etc/test
        actions:
           - type: None
 
$ oc apply -f file_action_none.yaml
Warning: resource machineconfigurations/cluster is missing the kubectl.kubernetes.io/last-applied-configuration annotation which is required by oc apply. oc apply should only be used on resources created declaratively by either oc create --save-config or oc apply. The missing annotation will be patched automatically.
machineconfiguration.operator.openshift.io/cluster configured

check the validatingadmissionpolicy in a cluster that featuregate is not enabled, the resource does not exist

$ oc get featuregate cluster -o yaml | yq -y '.spec'
{}

$ oc get validatingadmissionpolicy machine-configuration-guards -o yaml
error: the server doesn't have a resource type "validatingadmissionpolicy"

[rioliu-rh]

/unhold
/qe-approved

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD 2b45740 and 2 for PR HEAD ff14562 in total

[openshift-ci-robot]

@djoshy: Jira Issue OCPBUGS-32739: All pull requests linked via external trackers have merged:

• openshift/machine-config-operator#4332

Jira Issue OCPBUGS-32739 has been moved to the MODIFIED state.

In response to this:

This adds a new ValidatingAdmissionPolicy which rejects all MachineConfiguration objects not named "cluster".

How to test:

• Launch a cluster in TechPreview. Handy cluster bot command:

launch 4.16,openshift/machine-config-operator#4332 gcp,techpreview

If starting from default and transitioning to TechPreview, wait for the kube-apiserver operator to settle as this indicates that all the feature gates have been setup correctly. This can take up to 20 minutes, so I recommend the above method.

• Attempt to create a new CR of the type MachineConfiguration not named "cluster". Here is a sample object.

apiVersion: operator.openshift.io/v1
kind: MachineConfiguration
metadata:
 name: example-file
 namespace: openshift-machine-config-operator
spec:
 nodeDisruptionPolicy:
   files:
     - path: "/etc/example.sh"
       actions:
         - type: None

This should fail, with a message like this:

The machineconfigurations "example-file" is invalid: : ValidatingAdmissionPolicy 'machine-configuration-guards' with binding 'machine-configuration-guards-binding' denied request: Only a single object of MachineConfiguration is allowed and it must be named cluster.

This should be true for any object not named "cluster", regardless of the content.

• Now, rename the object you were trying to apply to "cluster", and try to apply it.

apiVersion: operator.openshift.io/v1
kind: MachineConfiguration
metadata:
 name: cluster
 namespace: openshift-machine-config-operator
spec:
 nodeDisruptionPolicy:
   files:
     - path: "/etc/example.sh"
       actions:
         - type: None

It should succeed:

machineconfiguration.operator.openshift.io/cluster configured

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-bot]

[ART PR BUILD NOTIFIER]

This PR has been included in build ose-machine-config-operator-container-v4.16.0-202404291018.p0.g41cfb04.assembly.stream.el9 for distgit ose-machine-config-operator.
All builds following this will include this PR.

[openshift-merge-robot]

Fix included in accepted release 4.16.0-0.nightly-2024-04-29-154406