Fix CSR validation failure for missing status conditions #1229

mansikulkarni96 · 2022-09-01T04:26:33Z

This PR aims to fix the issue with failing CSR validation of CSR's that have a missing status condition.
These CSR's cannot be approved, hence they need to be skipped.

Latest failure: https://prow.ci.openshift.org/view/gs/origin-ci-test/pr-logs/pull/openshift_windows-machine-config-operator/1258/pull-ci-openshift-windows-machine-config-operator-master-vsphere-e2e-operator/1577062440414220288

csr.json: https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/origin-ci-test/pr-logs/pull/openshift_windows-machine-config-operator/1258/pull-ci-openshift-windows-machine-config-operator-master-vsphere-e2e-operator/1577062440414220288/artifacts/vsphere-e2e-operator/gather-extra/artifacts/csr.json

"status": {}

mansikulkarni96 · 2022-09-01T04:27:08Z

/test vsphere-e2e-operator

mansikulkarni96 · 2022-09-07T14:30:33Z

/retest

jrvaldes · 2022-10-05T14:28:51Z

test/e2e/validation_test.go

@@ -665,6 +665,10 @@ func (tc *testContext) findNodeCSRs(nodeName string) ([]certificates.Certificate
 		return nil, errors.Wrap(err, "unable to get CSR list")
 	}
 	for _, c := range csrs.Items {
+		// skip the CSR if it's status has not been reported
+		if len(c.Status.Conditions) == 0 {


Conditions may be nil. Consider

if c.Status.Conditions == nil || len(c.Status.Conditions) == 0 { ... }

alinaryan · 2022-10-05T14:54:34Z

Thanks for working on this, LGTM so far. Will this be a temp workaround until we or the cloud team find a permanent fix?

mansikulkarni96 · 2022-10-05T15:09:53Z

Thanks for working on this, LGTM so far. Will this be a temp workaround until we or the cloud team find a permanent fix?

That is correct @alinaryan

aravindhp

Thanks for fixing this, @mansikulkarni96

aravindhp · 2022-10-05T15:16:58Z

test/e2e/validation_test.go

@@ -665,6 +665,10 @@ func (tc *testContext) findNodeCSRs(nodeName string) ([]certificates.Certificate
 		return nil, errors.Wrap(err, "unable to get CSR list")
 	}
 	for _, c := range csrs.Items {
+		// skip the CSR if it's status has not been reported


Please add the suspected reason here and in the commit message.

openshift-ci · 2022-10-05T15:36:53Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aravindhp, mansikulkarni96

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [aravindhp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

jrvaldes · 2022-10-05T15:45:55Z

LGTM

jrvaldes · 2022-10-05T16:14:09Z

/lgtm

This commit aims to fix the issue with failing CSR validation of CSR that have a missing status condition. In some cases, a CSR is left in pending state when a new CSR is created for a node too quickly before updating the status of the existing one. Such a CSR cannot be approved but it does not affect node configuration and is safe to be ignored.

aravindhp · 2022-10-10T23:45:19Z

Blocked by OCPBUGS-2175

openshift-ci-robot · 2022-10-12T22:38:36Z

/retest-required

Remaining retests: 0 against base HEAD 234a6cd and 1 for PR HEAD 3685963 in total

JacobTanenbaum · 2022-10-13T17:38:22Z

/retest

openshift-ci-robot · 2022-10-13T18:54:20Z

/retest-required

Remaining retests: 0 against base HEAD c6b350e and 0 for PR HEAD 3685963 in total

openshift-ci-robot · 2022-10-13T19:54:00Z

/hold

Revision 3685963 was retested 3 times: holding

JacobTanenbaum · 2022-10-14T14:00:58Z

/test azure-e2e-operator

JacobTanenbaum · 2022-10-14T14:15:24Z

/retest ci/prow/aws-e2e-operator

openshift-ci · 2022-10-14T14:15:45Z

@JacobTanenbaum: The /retest command does not accept any targets.
The following commands are available to trigger required jobs:

/test aws-e2e-ccm-install
/test aws-e2e-operator
/test aws-e2e-upgrade
/test azure-e2e-operator
/test build
/test ci-index
/test gcp-e2e-operator
/test images
/test lint
/test unit
/test vsphere-e2e-operator
/test wicd-unit-vsphere

The following commands are available to trigger optional jobs:

/test azure-e2e-ccm-install
/test platform-none-vsphere-e2e-operator
/test vsphere-e2e-ccm-install

Use /test all to run the following jobs that were automatically triggered:

pull-ci-openshift-windows-machine-config-operator-master-aws-e2e-ccm-install
pull-ci-openshift-windows-machine-config-operator-master-aws-e2e-operator
pull-ci-openshift-windows-machine-config-operator-master-aws-e2e-upgrade
pull-ci-openshift-windows-machine-config-operator-master-azure-e2e-operator
pull-ci-openshift-windows-machine-config-operator-master-build
pull-ci-openshift-windows-machine-config-operator-master-ci-index
pull-ci-openshift-windows-machine-config-operator-master-gcp-e2e-operator
pull-ci-openshift-windows-machine-config-operator-master-images
pull-ci-openshift-windows-machine-config-operator-master-lint
pull-ci-openshift-windows-machine-config-operator-master-unit
pull-ci-openshift-windows-machine-config-operator-master-vsphere-e2e-operator
pull-ci-openshift-windows-machine-config-operator-master-wicd-unit-vsphere

In response to this:

/retest ci/prow/aws-e2e-operator

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

JacobTanenbaum · 2022-10-14T14:16:00Z

/test aws-e2e-operator

patrickdillon · 2022-10-16T21:41:30Z

/test gcp-e2e-operator

patrickdillon · 2022-10-17T10:42:46Z

/test gcp-e2e-operator

patrickdillon · 2022-10-17T13:42:24Z

/test gcp-e2e-operator

patrickdillon · 2022-10-17T18:44:35Z

/test gcp-e2e-operator

patrickdillon · 2022-10-18T14:33:24Z

/test gcp-e2e-operator

patrickdillon · 2022-10-18T18:36:15Z

/test gcp-e2e-operator

barbacbd · 2022-10-24T12:19:51Z

/test gcp-e2e-operator

mtnbikenc · 2022-10-26T23:21:37Z

/retest

mtnbikenc · 2022-10-26T23:22:58Z

/hold cancel

mtnbikenc · 2022-10-27T12:59:43Z

/retest

mtnbikenc · 2022-10-27T14:49:19Z

@mansikulkarni96 the aws-e2e-operator job failed twice in the setup phase. Is this a new issue with AWS or a known flake?

mansikulkarni96 · 2022-10-27T15:25:13Z

There are issues creating EC2 instance, both jobs failed with different reasons though. Investigating.

mansikulkarni96 · 2022-10-27T17:40:32Z

/retest

aravindhp · 2022-10-27T18:03:37Z

/override ci/prow/aws-e2e-operator

The test past previously we are now seeing a flake on AWS cluster installs.

level=error msg=Error: creating EC2 Instance: InvalidNetworkInterfaceID.NotFound

openshift-ci · 2022-10-27T18:04:10Z

@aravindhp: Overrode contexts on behalf of aravindhp: ci/prow/aws-e2e-operator

In response to this:

/override ci/prow/aws-e2e-operator

The test past previously we are now seeing a flake on AWS cluster installs.
level=error msg=Error: creating EC2 Instance: InvalidNetworkInterfaceID.NotFound

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2022-10-27T18:09:40Z

@mansikulkarni96: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

mansikulkarni96 marked this pull request as draft September 1, 2022 04:26

openshift-ci bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. labels Sep 1, 2022

openshift-ci bot requested review from aravindhp and sebsoto September 1, 2022 04:28

mansikulkarni96 changed the title ~~[WIP] Fix failing CSR validation for pending CSR's~~ [WIP] Fix failing CSR validation for pending CSR Oct 4, 2022

mansikulkarni96 changed the title ~~[WIP] Fix failing CSR validation for pending CSR~~ [WIP] Fix CSR validation failure for missing status conditions Oct 4, 2022

mansikulkarni96 force-pushed the csr-check branch from b04df72 to 149aa90 Compare October 4, 2022 20:45

mansikulkarni96 changed the title ~~[WIP] Fix CSR validation failure for missing status conditions~~ Fix CSR validation failure for missing status conditions Oct 4, 2022

jrvaldes reviewed Oct 5, 2022

View reviewed changes

mansikulkarni96 force-pushed the csr-check branch from 35c76c1 to 11c6c29 Compare October 5, 2022 15:08

mansikulkarni96 requested review from jrvaldes and removed request for sebsoto and aravindhp October 5, 2022 15:10

aravindhp approved these changes Oct 5, 2022

View reviewed changes

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 5, 2022

mansikulkarni96 force-pushed the csr-check branch from 11c6c29 to bb755a3 Compare October 5, 2022 16:12

mansikulkarni96 marked this pull request as ready for review October 5, 2022 16:13

jrvaldes mentioned this pull request Oct 5, 2022

WINC-888: Use platform-specific tags in userData #1258

Merged

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 5, 2022

mansikulkarni96 force-pushed the csr-check branch 2 times, most recently from 5a25635 to dfaf333 Compare October 5, 2022 16:26

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 13, 2022

aravindhp mentioned this pull request Oct 26, 2022

[test] Fix naming of MachineSet #1286

Merged

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 26, 2022

openshift-merge-robot merged commit cd0c534 into openshift:master Oct 27, 2022

aravindhp mentioned this pull request Jan 13, 2023

[release-4.11] WINC-957: [submodule] Update to containerd v1.6.15 and hcsshim v0.9.6 #1383

Merged

Fix CSR validation failure for missing status conditions #1229

Fix CSR validation failure for missing status conditions #1229

Conversation

mansikulkarni96 commented Sep 1, 2022 • edited

mansikulkarni96 commented Sep 1, 2022

mansikulkarni96 commented Sep 7, 2022

jrvaldes Oct 5, 2022 • edited

Choose a reason for hiding this comment

alinaryan commented Oct 5, 2022

mansikulkarni96 commented Oct 5, 2022

aravindhp left a comment

Choose a reason for hiding this comment

aravindhp Oct 5, 2022

Choose a reason for hiding this comment

openshift-ci bot commented Oct 5, 2022

jrvaldes commented Oct 5, 2022

jrvaldes commented Oct 5, 2022

aravindhp commented Oct 10, 2022

openshift-ci-robot commented Oct 12, 2022

JacobTanenbaum commented Oct 13, 2022

openshift-ci-robot commented Oct 13, 2022

openshift-ci-robot commented Oct 13, 2022

JacobTanenbaum commented Oct 14, 2022

JacobTanenbaum commented Oct 14, 2022

openshift-ci bot commented Oct 14, 2022

JacobTanenbaum commented Oct 14, 2022

patrickdillon commented Oct 16, 2022

patrickdillon commented Oct 17, 2022

patrickdillon commented Oct 17, 2022

patrickdillon commented Oct 17, 2022

patrickdillon commented Oct 18, 2022

patrickdillon commented Oct 18, 2022

barbacbd commented Oct 24, 2022

mtnbikenc commented Oct 26, 2022

mtnbikenc commented Oct 26, 2022

mtnbikenc commented Oct 27, 2022

mtnbikenc commented Oct 27, 2022

mansikulkarni96 commented Oct 27, 2022

mansikulkarni96 commented Oct 27, 2022

aravindhp commented Oct 27, 2022

openshift-ci bot commented Oct 27, 2022

openshift-ci bot commented Oct 27, 2022

mansikulkarni96 commented Sep 1, 2022 •

edited

jrvaldes Oct 5, 2022 •

edited