Skip to content

Commit 34cce22

Browse files
hongkailiuhongkailiu
committed
OTA-1010: release extract: --include works for a minor level update
1 parent 02503fe commit 34cce22

8 files changed

+282
-13
lines changed

‎credentials-requests/0000_30_machine-api-operator_00_credentials-request.yaml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
---
2+
apiVersion: cloudcredential.openshift.io/v1
3+
kind: CredentialsRequest
4+
metadata:
5+
annotations:
6+
capability.openshift.io/name: MachineAPI
7+
exclude.release.openshift.io/internal-openshift-hosted: "true"
8+
include.release.openshift.io/self-managed-high-availability: "true"
9+
labels:
10+
controller-tools.k8s.io: "1.0"
11+
name: openshift-machine-api-aws
12+
namespace: openshift-cloud-credential-operator
13+
spec:
14+
providerSpec:
15+
apiVersion: cloudcredential.openshift.io/v1
16+
kind: AWSProviderSpec
17+
statementEntries:
18+
- action:
19+
- ec2:CreateTags
20+
- ec2:DescribeAvailabilityZones
21+
- ec2:DescribeDhcpOptions
22+
- ec2:DescribeImages
23+
- ec2:DescribeInstances
24+
- ec2:DescribeInstanceTypes
25+
- ec2:DescribeInternetGateways
26+
- ec2:DescribeSecurityGroups
27+
- ec2:DescribeRegions
28+
- ec2:DescribeSubnets
29+
- ec2:DescribeVpcs
30+
- ec2:RunInstances
31+
- ec2:TerminateInstances
32+
- elasticloadbalancing:DescribeLoadBalancers
33+
- elasticloadbalancing:DescribeTargetGroups
34+
- elasticloadbalancing:DescribeTargetHealth
35+
- elasticloadbalancing:RegisterInstancesWithLoadBalancer
36+
- elasticloadbalancing:RegisterTargets
37+
- elasticloadbalancing:DeregisterTargets
38+
- iam:PassRole
39+
- iam:CreateServiceLinkedRole
40+
effect: Allow
41+
resource: '*'
42+
- action:
43+
- kms:Decrypt
44+
- kms:Encrypt
45+
- kms:GenerateDataKey
46+
- kms:GenerateDataKeyWithoutPlainText
47+
- kms:DescribeKey
48+
effect: Allow
49+
resource: '*'
50+
- action:
51+
- kms:RevokeGrant
52+
- kms:CreateGrant
53+
- kms:ListGrants
54+
effect: Allow
55+
policyCondition:
56+
Bool:
57+
kms:GrantIsForAWSResource: true
58+
resource: '*'
59+
secretRef:
60+
name: aws-cloud-credentials
61+
namespace: openshift-machine-api
62+
serviceAccountNames:
63+
- machine-api-controllers

‎credentials-requests/0000_50_cloud-credential-operator_05-iam-ro-credentialsrequest.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
apiVersion: cloudcredential.openshift.io/v1
3+
kind: CredentialsRequest
4+
metadata:
5+
annotations:
6+
exclude.release.openshift.io/internal-openshift-hosted: "true"
7+
include.release.openshift.io/self-managed-high-availability: "true"
8+
name: cloud-credential-operator-iam-ro
9+
namespace: openshift-cloud-credential-operator
10+
spec:
11+
providerSpec:
12+
apiVersion: cloudcredential.openshift.io/v1
13+
kind: AWSProviderSpec
14+
statementEntries:
15+
- action:
16+
- iam:GetUser
17+
- iam:GetUserPolicy
18+
- iam:ListAccessKeys
19+
effect: Allow
20+
resource: '*'
21+
secretRef:
22+
name: cloud-credential-operator-iam-ro-creds
23+
namespace: openshift-cloud-credential-operator
24+
serviceAccountNames:
25+
- cloud-credential-operator

‎credentials-requests/0000_50_cluster-image-registry-operator_01-registry-credentials-request.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
apiVersion: cloudcredential.openshift.io/v1
3+
kind: CredentialsRequest
4+
metadata:
5+
annotations:
6+
capability.openshift.io/name: ImageRegistry
7+
include.release.openshift.io/ibm-cloud-managed: "true"
8+
include.release.openshift.io/self-managed-high-availability: "true"
9+
include.release.openshift.io/single-node-developer: "true"
10+
labels:
11+
controller-tools.k8s.io: "1.0"
12+
name: openshift-image-registry
13+
namespace: openshift-cloud-credential-operator
14+
spec:
15+
providerSpec:
16+
apiVersion: cloudcredential.openshift.io/v1
17+
kind: AWSProviderSpec
18+
statementEntries:
19+
- action:
20+
- s3:CreateBucket
21+
- s3:DeleteBucket
22+
- s3:PutBucketTagging
23+
- s3:GetBucketTagging
24+
- s3:PutBucketPublicAccessBlock
25+
- s3:GetBucketPublicAccessBlock
26+
- s3:PutEncryptionConfiguration
27+
- s3:GetEncryptionConfiguration
28+
- s3:PutLifecycleConfiguration
29+
- s3:GetLifecycleConfiguration
30+
- s3:GetBucketLocation
31+
- s3:ListBucket
32+
- s3:GetObject
33+
- s3:PutObject
34+
- s3:DeleteObject
35+
- s3:ListBucketMultipartUploads
36+
- s3:AbortMultipartUpload
37+
- s3:ListMultipartUploadParts
38+
effect: Allow
39+
resource: '*'
40+
secretRef:
41+
name: installer-cloud-credentials
42+
namespace: openshift-image-registry
43+
serviceAccountNames:
44+
- cluster-image-registry-operator
45+
- registry

‎credentials-requests/0000_50_cluster-ingress-operator_00-ingress-credentials-request.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
apiVersion: cloudcredential.openshift.io/v1
3+
kind: CredentialsRequest
4+
metadata:
5+
annotations:
6+
include.release.openshift.io/ibm-cloud-managed: "true"
7+
include.release.openshift.io/self-managed-high-availability: "true"
8+
include.release.openshift.io/single-node-developer: "true"
9+
labels:
10+
controller-tools.k8s.io: "1.0"
11+
name: openshift-ingress
12+
namespace: openshift-cloud-credential-operator
13+
spec:
14+
providerSpec:
15+
apiVersion: cloudcredential.openshift.io/v1
16+
kind: AWSProviderSpec
17+
statementEntries:
18+
- action:
19+
- elasticloadbalancing:DescribeLoadBalancers
20+
- route53:ListHostedZones
21+
- route53:ListTagsForResources
22+
- route53:ChangeResourceRecordSets
23+
- tag:GetResources
24+
- sts:AssumeRole
25+
effect: Allow
26+
resource: '*'
27+
secretRef:
28+
name: cloud-credentials
29+
namespace: openshift-ingress-operator
30+
serviceAccountNames:
31+
- ingress-operator

‎credentials-requests/0000_50_cluster-network-operator_02-cncc-credentials.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
apiVersion: cloudcredential.openshift.io/v1
3+
kind: CredentialsRequest
4+
metadata:
5+
annotations:
6+
include.release.openshift.io/ibm-cloud-managed: "true"
7+
include.release.openshift.io/self-managed-high-availability: "true"
8+
include.release.openshift.io/single-node-developer: "true"
9+
name: openshift-cloud-network-config-controller-aws
10+
namespace: openshift-cloud-credential-operator
11+
spec:
12+
providerSpec:
13+
apiVersion: cloudcredential.openshift.io/v1
14+
kind: AWSProviderSpec
15+
statementEntries:
16+
- action:
17+
- ec2:DescribeInstances
18+
- ec2:DescribeInstanceStatus
19+
- ec2:DescribeInstanceTypes
20+
- ec2:UnassignPrivateIpAddresses
21+
- ec2:AssignPrivateIpAddresses
22+
- ec2:UnassignIpv6Addresses
23+
- ec2:AssignIpv6Addresses
24+
- ec2:DescribeSubnets
25+
- ec2:DescribeNetworkInterfaces
26+
effect: Allow
27+
resource: '*'
28+
secretRef:
29+
name: cloud-credentials
30+
namespace: openshift-cloud-network-config-controller
31+
serviceAccountNames:
32+
- cloud-network-config-controller

‎credentials-requests/0000_50_cluster-storage-operator_03_credentials_request_aws.yaml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
---
2+
apiVersion: cloudcredential.openshift.io/v1
3+
kind: CredentialsRequest
4+
metadata:
5+
annotations:
6+
capability.openshift.io/name: Storage
7+
include.release.openshift.io/self-managed-high-availability: "true"
8+
include.release.openshift.io/single-node-developer: "true"
9+
name: aws-ebs-csi-driver-operator
10+
namespace: openshift-cloud-credential-operator
11+
spec:
12+
providerSpec:
13+
apiVersion: cloudcredential.openshift.io/v1
14+
kind: AWSProviderSpec
15+
statementEntries:
16+
- action:
17+
- ec2:AttachVolume
18+
- ec2:CreateSnapshot
19+
- ec2:CreateTags
20+
- ec2:CreateVolume
21+
- ec2:DeleteSnapshot
22+
- ec2:DeleteTags
23+
- ec2:DeleteVolume
24+
- ec2:DescribeInstances
25+
- ec2:DescribeSnapshots
26+
- ec2:DescribeTags
27+
- ec2:DescribeVolumes
28+
- ec2:DescribeVolumesModifications
29+
- ec2:DetachVolume
30+
- ec2:ModifyVolume
31+
- ec2:DescribeAvailabilityZones
32+
- ec2:EnableFastSnapshotRestores
33+
effect: Allow
34+
resource: '*'
35+
- action:
36+
- kms:ReEncrypt*
37+
- kms:Decrypt
38+
- kms:Encrypt
39+
- kms:GenerateDataKey
40+
- kms:GenerateDataKeyWithoutPlainText
41+
- kms:DescribeKey
42+
effect: Allow
43+
resource: '*'
44+
- action:
45+
- kms:RevokeGrant
46+
- kms:CreateGrant
47+
- kms:ListGrants
48+
effect: Allow
49+
policyCondition:
50+
Bool:
51+
kms:GrantIsForAWSResource: true
52+
resource: '*'
53+
secretRef:
54+
name: ebs-cloud-credentials
55+
namespace: openshift-cluster-csi-drivers
56+
serviceAccountNames:
57+
- aws-ebs-csi-driver-operator
58+
- aws-ebs-csi-driver-controller-sa

‎pkg/cli/admin/release/extract.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,8 @@ func NewExtract(f kcmdutil.Factory, streams genericiooptions.IOStreams) *cobra.C
9494
If --install-config is set, it will be used to determine the expected cluster configuration,
9595
otherwise the command will interrogate your current cluster to determine its configuration.
9696
This command is most accurate when the version of the extracting client matches the version
97-
of the cluster under consideration.
97+
of the cluster under consideration. Otherwise, for example, newly introduced capacities in
98+
the version of the extracting client are considered enabled.
9899
99100
Instead of extracting the manifests, you can specify --git=DIR to perform a Git
100101
checkout of the source code that comprises the release. A warning will be printed

‎pkg/cli/admin/release/extract_tools.go‎

Lines changed: 26 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@ import (
1414
"io"
1515
"os"
1616
"path/filepath"
17-
"regexp"
1817
"runtime"
1918
"sort"
2019
"strings"
@@ -1238,18 +1237,33 @@ func findClusterIncludeConfig(ctx context.Context, restConfig *rest.Config) (man
12381237
config.Overrides = clusterVersion.Spec.Overrides
12391238
config.Capabilities = &clusterVersion.Status.Capabilities
12401239

1241-
// FIXME: eventually pull in GetImplicitlyEnabledCapabilities from https://github.com/openshift/cluster-version-operator/blob/86e24d66119a73f50282b66a8d6f2e3518aa0e15/pkg/payload/payload.go#L237-L240 for cases where a minor update would implicitly enable some additional capabilities. For now, 4.13 to 4.14 will always enable MachineAPI, ImageRegistry, etc..
1242-
currentVersion := clusterVersion.Status.Desired.Version
1243-
matches := regexp.MustCompile(`^(\d+[.]\d+)[.].*`).FindStringSubmatch(currentVersion)
1244-
if len(matches) < 2 {
1245-
return config, fmt.Errorf("failed to parse major.minor version from ClusterVersion status.desired.version %q", currentVersion)
1246-
} else if matches[1] == "4.13" {
1247-
build := configv1.ClusterVersionCapability("Build")
1248-
deploymentConfig := configv1.ClusterVersionCapability("DeploymentConfig")
1249-
imageRegistry := configv1.ClusterVersionCapability("ImageRegistry")
1250-
config.Capabilities.EnabledCapabilities = append(config.Capabilities.EnabledCapabilities, configv1.ClusterVersionCapabilityMachineAPI, build, deploymentConfig, imageRegistry)
1251-
config.Capabilities.KnownCapabilities = append(config.Capabilities.KnownCapabilities, configv1.ClusterVersionCapabilityMachineAPI, build, deploymentConfig, imageRegistry)
1240+
// The set of the capabilities defined in configv1.ClusterVersionCapabilitySets may grow over time.
1241+
// Here we refresh "known" and "enabled" from lib so the new capabilities are included.
1242+
known := sets.New[configv1.ClusterVersionCapability]()
1243+
for _, s := range configv1.ClusterVersionCapabilitySets {
1244+
known.Insert(s...)
12521245
}
1246+
previouslyKnown := sets.New[configv1.ClusterVersionCapability](config.Capabilities.KnownCapabilities...)
1247+
config.Capabilities.KnownCapabilities = previouslyKnown.Union(known).UnsortedList()
1248+
1249+
key := configv1.ClusterVersionCapabilitySetCurrent
1250+
if clusterVersion.Spec.Capabilities != nil && clusterVersion.Spec.Capabilities.BaselineCapabilitySet != "" {
1251+
key = clusterVersion.Spec.Capabilities.BaselineCapabilitySet
1252+
}
1253+
enabled := sets.New[configv1.ClusterVersionCapability](configv1.ClusterVersionCapabilitySets[key]...)
1254+
// Without downloading the payload that is running on the cluster, it is hard to collect all the enabled capabilities.
1255+
// We may create a manifest in dry-run mode on the cluster and check if the output contains the existing error
1256+
// which indicates the capabilities of the manifest are all enabled. We have to wait until all manifests are checked
1257+
// this way to collect the complete set of enabled capabilities.It might not be worth the effort to calculate the
1258+
// exact enabled capabilities.
1259+
// Instead, newly introduced capabilities are blindly enabled and some of them might not be actually enabled on the cluster.
1260+
// As a result, unexpected manifests could be included. The number of such manifests is likely small, provided that
1261+
// only a small amount of capabilities are added over time and that happens only for minor level updates:
1262+
// #C(4.11)=4 -> #C(4.17)=15, averagely less than two per minor update.
1263+
// https://docs.openshift.com/container-platform/4.17/installing/overview/cluster-capabilities.html
1264+
deltaKnown := known.Difference(previouslyKnown)
1265+
enabled = enabled.Union(deltaKnown)
1266+
config.Capabilities.EnabledCapabilities = sets.New[configv1.ClusterVersionCapability](config.Capabilities.EnabledCapabilities...).Union(enabled).UnsortedList()
12531267
}
12541268

12551269
if infrastructure, err := client.Infrastructures().Get(ctx, "cluster", metav1.GetOptions{}); err != nil {

0 commit comments

Comments
 (0)