strip off the old openshift namespace finalizer

[deads2k]

This updates our existing finalizer to always and immediately remove the origin finalizer from namespaces. We no longer need it and this removes the cruft getting ready for an upgrade.

@sdodson how easy/hard is it to add a pre-upgrade step for 3.12 that checks to make sure that no namespace has a .spec.finalizers array that contains "openshift.io/origin"?

/assign @liggitt @mfojtik

[liggitt]

/lgtm

[mfojtik]

/lgtm as well

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deads2k, liggitt, mfojtik

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• pkg/oc/OWNERS [deads2k,liggitt,mfojtik]
• pkg/project/OWNERS [deads2k,liggitt,mfojtik]
• test/integration/OWNERS [deads2k,liggitt,mfojtik]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sdodson]

@sdodson how easy/hard is it to add a pre-upgrade step for 3.12 that checks to make sure that no namespace has a .spec.finalizers array that contains "openshift.io/origin"?

Doable, can you give me a namespace definition that I can use as a test case?

[deads2k]

/retest

[deads2k]

@sdodson how easy/hard is it to add a pre-upgrade step for 3.12 that checks to make sure that no namespace has a .spec.finalizers array that contains "openshift.io/origin"?

Doable, can you give me a namespace definition that I can use as a test case?

@sdodson
With

[deads@deads-02 origin]$ oc get ns foo -oyaml
apiVersion: v1
kind: Namespace
metadata:
  annotations:
    openshift.io/description: ""
    openshift.io/display-name: ""
    openshift.io/requester: system:admin
    openshift.io/sa.scc.mcs: s0:c8,c2
    openshift.io/sa.scc.supplemental-groups: 1000060000/10000
    openshift.io/sa.scc.uid-range: 1000060000/10000
  creationTimestamp: 2018-07-12T20:00:23Z
  name: foo
  resourceVersion: "9747"
  selfLink: /api/v1/namespaces/foo
  uid: 366dba60-860e-11e8-aa16-54e1ad486dd3
spec:
  finalizers:
  - openshift.io/origin
  - kubernetes
status:
  phase: Active

Without

[deads@deads-02 origin]$ oc get ns default -oyaml
apiVersion: v1
kind: Namespace
metadata:
  annotations:
    openshift.io/sa.scc.mcs: s0:c1,c0
    openshift.io/sa.scc.supplemental-groups: 1000000000/10000
    openshift.io/sa.scc.uid-range: 1000000000/10000
  creationTimestamp: 2018-07-12T15:54:13Z
  name: default
  resourceVersion: "444"
  selfLink: /api/v1/namespaces/default
  uid: d2c34638-85eb-11e8-ad1a-54e1ad486dd3
spec:
  finalizers:
  - kubernetes
status:
  phase: Active

[deads2k]

@sdodson In 3.11 we have a controller which unconditionally removes the openshift finalizer. If they still have namespaces with the finalizer, the expectation is that simply letting the controllers run for 3.11 will remove it.