Fix ROSA account-roles-create overriding specific patch versions#79295
Fix ROSA account-roles-create overriding specific patch versions#79295Sandeepyadav93 wants to merge 1 commit into
Conversation
The account-roles-create step was unconditionally writing the truncated
version (e.g., "4.21") to ${SHARED_DIR}/openshift_version, even when no
fallback occurred. This caused the provision step to override specific
patch version requests (e.g., OPENSHIFT_VERSION: 4.21.13) with the
latest available version in that minor release (e.g., 4.21.15).
The openshift_version file is intended to communicate fallback versions
when account role creation fails with the requested version and must
retry with a newer one. It should not be written during normal operations
where the user's requested version succeeds.
Changes:
- Add FALLBACK_OCCURRED flag to track actual fallback events
- Only write openshift_version file when fallback actually occurs
- Update log message to clarify it's storing a fallback version
This ensures that when users specify exact versions like "4.21.13" in
their job configs, the cluster is provisioned with that exact version
rather than being upgraded to the latest available patch release.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
WalkthroughA shell script for ROSA account-role creation is updated to track when a version fallback occurs during retry logic, and conditionally writes the fallback version to shared output only when fallback actually happened rather than for all resolved versions. ChangesFallback Version Tracking and Conditional Output
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 12✅ Passed checks (12 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: Sandeepyadav93 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
[REHEARSALNOTIFIER]
A total of 307 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs. A full list of affected jobs can be found here Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/assign @dustman9000 Hello Dustin. I see you recently updated this logic, will appreciate your review. |
|
@Sandeepyadav93: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
The account-roles-create step was unconditionally writing the truncated version (e.g., "4.21") to ${SHARED_DIR}/openshift_version, even when no fallback occurred. This caused the provision step to override specific patch version requests (e.g., OPENSHIFT_VERSION: 4.21.13) with the latest available version in that minor release (e.g., 4.21.15).
The openshift_version file is intended to communicate fallback versions when account role creation fails with the requested version and must retry with a newer one. It should not be written during normal operations where the user's requested version succeeds.
Changes:
This ensures that when users specify exact versions like "4.21.13" in their job configs, the cluster is provisioned with that exact version rather than being upgraded to the latest available patch release.
Fix ROSA account-roles-create overriding specific patch versions
This PR fixes an issue in the ROSA (Red Hat OpenShift Service on AWS) CI infrastructure where the
account-roles-createstep was unintentionally overriding user-specified OpenShift patch versions.Problem
The
account-roles-createstep was unconditionally writing a truncated minor version (e.g., "4.21") to${SHARED_DIR}/openshift_versioneven when no fallback was necessary. This caused the downstream provision step to replace user-requested specific patch versions (e.g.,OPENSHIFT_VERSION: 4.21.13) with the latest patch available in that minor release (e.g., 4.21.15), breaking reproducible cluster provisioning.Solution
Modified the
rosa-sts-account-roles-create-commands.shstep to:FALLBACK_OCCURREDflag initialized tofalsethat tracks whether account role creation actually required falling back to a different OpenShift versionFALLBACK_OCCURRED=trueonly when the fallback retry path is executed with a different versionopenshift_versionto the shared directory only when a fallback has genuinely occurred (checking both the flag and thatOPENSHIFT_VERSIONis set)Impact
The fix ensures that exact user-specified OpenShift patch versions are preserved during normal CI operations. The
openshift_versionfile is now correctly used only as a fallback communication mechanism when account role creation fails with the requested version and must retry with an alternative version, preventing unintended version overrides in downstream provisioning steps.