OCPBUGS-61890: 🐛 CRD upgrade safety fixes and ratcheting (#2123)

[jianzhangbjz]

Manually cherry-pick operator-framework/operator-controller@236319b to release-4.20

[openshift-ci-robot]

@jianzhangbjz: This pull request references Jira Issue OCPBUGS-61890, which is invalid:

• release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
• expected Jira Issue OCPBUGS-61890 to depend on a bug targeting a version in 4.21.0 and in one of the following states: MODIFIED, ON_QA, VERIFIED, but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Manually cherry-pick operator-framework/operator-controller@236319b to release-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jianzhangbjz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• DOWNSTREAM_OWNERS [jianzhangbjz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jianzhangbjz]

/jira refresh

[openshift-ci-robot]

@jianzhangbjz: This pull request references Jira Issue OCPBUGS-61890, which is invalid:

• expected dependent Jira Issue OCPBUGS-58462 to target a version in 4.21.0, but it targets "4.21" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[jianzhangbjz]

/jira refresh

[openshift-ci-robot]

@jianzhangbjz: This pull request references Jira Issue OCPBUGS-61890, which is valid. The bug has been moved to the POST state.

7 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.20.0) matches configured target version for branch (4.20.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)
• release note type set to "Release Note Not Required"
• dependent bug Jira Issue OCPBUGS-58462 is in the state Verified, which is one of the valid states (MODIFIED, ON_QA, VERIFIED)
• dependent Jira Issue OCPBUGS-58462 targets the "4.21.0" version, which is one of the valid target versions: 4.21.0
• bug has dependents

Requesting review from QA contact:
/cc @Xia-Zhao-rh

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[joelanford]

/lgtm

[joelanford]

/label backport-risk-assessed

[joelanford]

/label staff-eng-approved

4.20.0-rc3 was promoted to 4.20.0, so less of a concern about risk of merging 4.20 code at this point.

[jianzhangbjz]

Test passed.

1. Build an OCP cluster with this unmerged PR via the cluster-bot
launch 4.20,openshift/operator-framework-operator-controller#527 aws

jiazha-mac:~ jiazha$ oc get clusterversion
NAME      VERSION                                                AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.20.0-0-2025-10-17-033102-test-ci-ln-79q39gb-latest   True        False         4m43s   Cluster version is 4.20.0-0-2025-10-17-033102-test-ci-ln-79q39gb-latest

2. Run test case 83026
jiazha-mac:openshift-tests-private jiazha$ ./bin/extended-platform-tests run all --dry-run|grep 83026|./bin/extended-platform-tests run -f -
  I1017 12:27:22.073909 42372 test.go:180] Found authentication type used: 
  I1017 12:27:22.074686 42372 test_context.go:566] The --provider flag is not set. Continuing as if --provider=skeleton had been used.
  I1017 12:27:25.292663 42372 client.go:1023] Running 'oc --kubeconfig=/Users/jiazha/bot-kubeconfig get node -l node-role.kubernetes.io/worker -o=jsonpath={.items[*].metadata.name}'
  I1017 12:27:27.237913 42372 api.go:57] EnvIsKubernetesCluster = no, start monitoring ClusterOperators and ClusterVersions
started: (0/1/1) "[sig-operators] OLM v1 oprun should Author:jiazha-ROSA-OSD_CCS-ARO-NonHyperShiftHOST-ConnectedOnly-High-83026-clusterextension updates sometimes failed with the following error from the CRDUpgradeCheck resource: unknown change, refusing to determine that change is safe."
...
...
  I1017 12:29:30.562860 42380 framework.go:376] Found DeleteNamespace=false, skipping namespace deletion!
  • SUCCESS! 1m56.498186792s 
passed: (2m3s) 2025-10-17T04:29:30 "[sig-operators] OLM v1 oprun should Author:jiazha-ROSA-OSD_CCS-ARO-NonHyperShiftHOST-ConnectedOnly-High-83026-clusterextension updates sometimes failed with the following error from the CRDUpgradeCheck resource: unknown change, refusing to determine that change is safe."

1 pass, 0 skip (2m3s)

/verified by @jianzhangbjz

[openshift-ci-robot]

@jianzhangbjz: This PR has been marked as verified by @jianzhangbjz.

In response to this:

Test passed.

1. Build an OCP cluster with this unmerged PR via the cluster-bot
launch 4.20,openshift/operator-framework-operator-controller#527 aws

jiazha-mac:~ jiazha$ oc get clusterversion
NAME      VERSION                                                AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.20.0-0-2025-10-17-033102-test-ci-ln-79q39gb-latest   True        False         4m43s   Cluster version is 4.20.0-0-2025-10-17-033102-test-ci-ln-79q39gb-latest

2. Run test case 83026
jiazha-mac:openshift-tests-private jiazha$ ./bin/extended-platform-tests run all --dry-run|grep 83026|./bin/extended-platform-tests run -f -
 I1017 12:27:22.073909 42372 test.go:180] Found authentication type used: 
 I1017 12:27:22.074686 42372 test_context.go:566] The --provider flag is not set. Continuing as if --provider=skeleton had been used.
 I1017 12:27:25.292663 42372 client.go:1023] Running 'oc --kubeconfig=/Users/jiazha/bot-kubeconfig get node -l node-role.kubernetes.io/worker -o=jsonpath={.items[*].metadata.name}'
 I1017 12:27:27.237913 42372 api.go:57] EnvIsKubernetesCluster = no, start monitoring ClusterOperators and ClusterVersions
started: (0/1/1) "[sig-operators] OLM v1 oprun should Author:jiazha-ROSA-OSD_CCS-ARO-NonHyperShiftHOST-ConnectedOnly-High-83026-clusterextension updates sometimes failed with the following error from the CRDUpgradeCheck resource: unknown change, refusing to determine that change is safe."
...
...
 I1017 12:29:30.562860 42380 framework.go:376] Found DeleteNamespace=false, skipping namespace deletion!
 • SUCCESS! 1m56.498186792s 
passed: (2m3s) 2025-10-17T04:29:30 "[sig-operators] OLM v1 oprun should Author:jiazha-ROSA-OSD_CCS-ARO-NonHyperShiftHOST-ConnectedOnly-High-83026-clusterextension updates sometimes failed with the following error from the CRDUpgradeCheck resource: unknown change, refusing to determine that change is safe."

1 pass, 0 skip (2m3s)

/verified by @jianzhangbjz

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@jianzhangbjz: Jira Issue Verification Checks: Jira Issue OCPBUGS-61890
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-61890 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

In response to this:

Manually cherry-pick operator-framework/operator-controller@236319b to release-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[jianzhangbjz]

/cherry-pick release-4.19

[openshift-cherrypick-robot]

@jianzhangbjz: #527 failed to apply on top of branch "release-4.19":

Applying: UPSTREAM: <carry>: 🐛 CRD upgrade safety fixes and ratcheting (#2123)
error: mode change for testdata/manifests/crd-unhandled-new.json, which is not in current HEAD
error: could not build fake ancestor
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0001 UPSTREAM: <carry>: 🐛 CRD upgrade safety fixes and ratcheting (#2123)

In response to this:

/cherry-pick release-4.19

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.