[release-4.22] OCPBUGS-98603: Move RBAC manifests to the services that own them#7042
Conversation
The cluster-policy-controller RBAC was applied by infrastructure-services-manager, forcing cluster-policy-controller to depend on it. This created a deadlock on restart: infrastructure-services-manager creates deployments whose SCC admission blocks for up to 13s waiting for namespace UID-range annotations, but those annotations are set by the namespace-security-allocation-controller inside cluster-policy-controller, which cannot start until infrastructure-services-manager finishes. On a fresh boot this was masked because target namespaces did not exist yet and the deployment create timed out at the client side, allowing a retry after the annotations were set. On restart the namespaces already exist, so the deployment create goes straight to admission and the deadlock is exposed. Move each service's RBAC into its own Run method: - cluster-policy-controller applies its 6 RBAC manifests and drops the infrastructure-services-manager dependency, restoring the original dependency on kube-apiserver only - kube-controller-manager applies its CSR approver RBAC alongside its own namespaces - infrastructure-services-manager no longer applies RBAC for other services Bug: https://issues.redhat.com/browse/OCPBUGS-98219
The previous commit broke the circular dependency but left a race: infrastructure-services-manager could still submit deployment creates before cluster-policy-controller had annotated namespaces with openshift.io/sa.scc.uid-range, depending on CPU speed. Start the controller in a goroutine and poll the default namespace for the UID range annotation before signaling ready. Add cluster-policy-controller as a dependency of infrastructure-services-manager so that deployment creates are guaranteed to pass SCC admission regardless of system load. Bug: https://issues.redhat.com/browse/OCPBUGS-98219
- Use select on errCh and waitCh so that if the controller dies before the readiness poll completes, the error is surfaced immediately instead of blocking forever - Log progress every 5 attempts during the readiness poll to make hangs diagnosable - Fix comment: the annotation check guarantees SCC admission will not block, but does not prove the controller is running on restart (the annotation persists from the previous boot) - Differentiate cluster role vs cluster role binding error messages in both CPC and KCM Bug: https://issues.redhat.com/browse/OCPBUGS-98219
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
@openshift-cherrypick-robot: Jira Issue OCPBUGS-98219 has been cloned as Jira Issue OCPBUGS-98603. Will retitle bug to link to clone. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
changed the title
openshift-ci-robot
added
jira/severity-important
|
@openshift-cherrypick-robot: This pull request references Jira Issue OCPBUGS-98603, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@pacevedom: This pull request references Jira Issue OCPBUGS-98603, which is valid. The bug has been moved to the POST state. 7 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/lgtm |
openshift-ci
Bot
added
the
backport-risk-assessed
|
@ggiguash: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
verified
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ggiguash, openshift-cherrypick-robot The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
@openshift-cherrypick-robot: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
openshift-merge-bot
Bot
merged commit ffe9781
into
openshift:release-4.22
|
@openshift-cherrypick-robot: Jira Issue OCPBUGS-98603: All pull requests linked via external trackers have merged: All linked pull requests have the DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
4 participants
This is an automated cherry-pick of #7029
/assign pacevedom