UPSTREAM: <carry>: protect key openshift namespaces

[deads2k]

Given an operator based installation, the only two namespaces that need to be protected are openshift-config (user defined information that we cannot recreate) and openshift-cluster-version (the CVO which is responsible for recreating all the rest).

/assign @derekwaynecarr @smarterclayton

[derekwaynecarr]

i am inclined to also protect openshift-cluster-api

/cc @enxebre for input.

[deads2k]

i am inclined to also protect openshift-cluster-api

/cc @enxebre for input.

Only if deleting that namespace actually results in some cluster change and I wouldn't expect it to. The API driving machines ought to be cluster scoped

[enxebre]

Only if deleting that namespace actually results in some cluster change and I wouldn't expect it to.
The API driving machines ought to be cluster scoped

openshift-cluster-api contains all the controllers watching machine resources plus the machine objects generated by the installer. The reason for Machines to be namespaced is the use case where one root cluster colocate machine objects managing child clusters. Protect it sounds reasonable.
Fwiw We are considering to rename it to openshift-machine-api

[derekwaynecarr]

@deads2k deleting that namespace will delete all computers managing the cluster in IPI mode, and all elastic compute in a UPI install.

[deads2k]

@deads2k deleting that namespace will delete all computers managing the cluster in IPI mode, and all elastic compute in a UPI install.

Which name would you like to protect? Since it's baked into our fork of kube, renaming is possible, but painful during the transition.

[deads2k]

If you change the name, be sure to update this patch.

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deads2k

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• test/integration/OWNERS [deads2k]
• vendor/k8s.io/kubernetes/staging/src/k8s.io/apiserver/OWNERS [deads2k]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[deads2k]

/retest

[derekwaynecarr]

we can send a follow-up.

[deads2k]

/retest

[deads2k]

/retest

[openshift-ci-robot]

@deads2k: The following tests failed, say /retest to rerun them all:

Test name	Commit	Details	Rerun command
ci/prow/e2e-aws-all	6c7efee	link	/test e2e-aws-all
ci/prow/e2e-aws-builds	6c7efee	link	/test e2e-aws-builds
ci/prow/e2e-aws-image-ecosystem	6c7efee	link	/test e2e-aws-image-ecosystem
ci/prow/e2e-aws-image-registry	6c7efee	link	/test e2e-aws-image-registry
ci/prow/e2e-conformance-k8s	6c7efee	link	/test e2e-conformance-k8s
ci/prow/launch-aws	6c7efee	link	/test launch-aws

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[mfojtik]

/retest