Skip to content

Commit cff3929

Browse files
hongkailiuhongkailiu
committed
OTA-1010: release extract: --include works for a minor level update
1 parent 02503fe commit cff3929

8 files changed

+298
-28
lines changed

‎credentials-requests/0000_30_machine-api-operator_00_credentials-request.yaml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
---
2+
apiVersion: cloudcredential.openshift.io/v1
3+
kind: CredentialsRequest
4+
metadata:
5+
annotations:
6+
capability.openshift.io/name: MachineAPI
7+
exclude.release.openshift.io/internal-openshift-hosted: "true"
8+
include.release.openshift.io/self-managed-high-availability: "true"
9+
labels:
10+
controller-tools.k8s.io: "1.0"
11+
name: openshift-machine-api-aws
12+
namespace: openshift-cloud-credential-operator
13+
spec:
14+
providerSpec:
15+
apiVersion: cloudcredential.openshift.io/v1
16+
kind: AWSProviderSpec
17+
statementEntries:
18+
- action:
19+
- ec2:CreateTags
20+
- ec2:DescribeAvailabilityZones
21+
- ec2:DescribeDhcpOptions
22+
- ec2:DescribeImages
23+
- ec2:DescribeInstances
24+
- ec2:DescribeInstanceTypes
25+
- ec2:DescribeInternetGateways
26+
- ec2:DescribeSecurityGroups
27+
- ec2:DescribeRegions
28+
- ec2:DescribeSubnets
29+
- ec2:DescribeVpcs
30+
- ec2:RunInstances
31+
- ec2:TerminateInstances
32+
- elasticloadbalancing:DescribeLoadBalancers
33+
- elasticloadbalancing:DescribeTargetGroups
34+
- elasticloadbalancing:DescribeTargetHealth
35+
- elasticloadbalancing:RegisterInstancesWithLoadBalancer
36+
- elasticloadbalancing:RegisterTargets
37+
- elasticloadbalancing:DeregisterTargets
38+
- iam:PassRole
39+
- iam:CreateServiceLinkedRole
40+
effect: Allow
41+
resource: '*'
42+
- action:
43+
- kms:Decrypt
44+
- kms:Encrypt
45+
- kms:GenerateDataKey
46+
- kms:GenerateDataKeyWithoutPlainText
47+
- kms:DescribeKey
48+
effect: Allow
49+
resource: '*'
50+
- action:
51+
- kms:RevokeGrant
52+
- kms:CreateGrant
53+
- kms:ListGrants
54+
effect: Allow
55+
policyCondition:
56+
Bool:
57+
kms:GrantIsForAWSResource: true
58+
resource: '*'
59+
secretRef:
60+
name: aws-cloud-credentials
61+
namespace: openshift-machine-api
62+
serviceAccountNames:
63+
- machine-api-controllers

‎credentials-requests/0000_50_cloud-credential-operator_05-iam-ro-credentialsrequest.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
apiVersion: cloudcredential.openshift.io/v1
3+
kind: CredentialsRequest
4+
metadata:
5+
annotations:
6+
exclude.release.openshift.io/internal-openshift-hosted: "true"
7+
include.release.openshift.io/self-managed-high-availability: "true"
8+
name: cloud-credential-operator-iam-ro
9+
namespace: openshift-cloud-credential-operator
10+
spec:
11+
providerSpec:
12+
apiVersion: cloudcredential.openshift.io/v1
13+
kind: AWSProviderSpec
14+
statementEntries:
15+
- action:
16+
- iam:GetUser
17+
- iam:GetUserPolicy
18+
- iam:ListAccessKeys
19+
effect: Allow
20+
resource: '*'
21+
secretRef:
22+
name: cloud-credential-operator-iam-ro-creds
23+
namespace: openshift-cloud-credential-operator
24+
serviceAccountNames:
25+
- cloud-credential-operator

‎credentials-requests/0000_50_cluster-image-registry-operator_01-registry-credentials-request.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
apiVersion: cloudcredential.openshift.io/v1
3+
kind: CredentialsRequest
4+
metadata:
5+
annotations:
6+
capability.openshift.io/name: ImageRegistry
7+
include.release.openshift.io/ibm-cloud-managed: "true"
8+
include.release.openshift.io/self-managed-high-availability: "true"
9+
include.release.openshift.io/single-node-developer: "true"
10+
labels:
11+
controller-tools.k8s.io: "1.0"
12+
name: openshift-image-registry
13+
namespace: openshift-cloud-credential-operator
14+
spec:
15+
providerSpec:
16+
apiVersion: cloudcredential.openshift.io/v1
17+
kind: AWSProviderSpec
18+
statementEntries:
19+
- action:
20+
- s3:CreateBucket
21+
- s3:DeleteBucket
22+
- s3:PutBucketTagging
23+
- s3:GetBucketTagging
24+
- s3:PutBucketPublicAccessBlock
25+
- s3:GetBucketPublicAccessBlock
26+
- s3:PutEncryptionConfiguration
27+
- s3:GetEncryptionConfiguration
28+
- s3:PutLifecycleConfiguration
29+
- s3:GetLifecycleConfiguration
30+
- s3:GetBucketLocation
31+
- s3:ListBucket
32+
- s3:GetObject
33+
- s3:PutObject
34+
- s3:DeleteObject
35+
- s3:ListBucketMultipartUploads
36+
- s3:AbortMultipartUpload
37+
- s3:ListMultipartUploadParts
38+
effect: Allow
39+
resource: '*'
40+
secretRef:
41+
name: installer-cloud-credentials
42+
namespace: openshift-image-registry
43+
serviceAccountNames:
44+
- cluster-image-registry-operator
45+
- registry

‎credentials-requests/0000_50_cluster-ingress-operator_00-ingress-credentials-request.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
apiVersion: cloudcredential.openshift.io/v1
3+
kind: CredentialsRequest
4+
metadata:
5+
annotations:
6+
include.release.openshift.io/ibm-cloud-managed: "true"
7+
include.release.openshift.io/self-managed-high-availability: "true"
8+
include.release.openshift.io/single-node-developer: "true"
9+
labels:
10+
controller-tools.k8s.io: "1.0"
11+
name: openshift-ingress
12+
namespace: openshift-cloud-credential-operator
13+
spec:
14+
providerSpec:
15+
apiVersion: cloudcredential.openshift.io/v1
16+
kind: AWSProviderSpec
17+
statementEntries:
18+
- action:
19+
- elasticloadbalancing:DescribeLoadBalancers
20+
- route53:ListHostedZones
21+
- route53:ListTagsForResources
22+
- route53:ChangeResourceRecordSets
23+
- tag:GetResources
24+
- sts:AssumeRole
25+
effect: Allow
26+
resource: '*'
27+
secretRef:
28+
name: cloud-credentials
29+
namespace: openshift-ingress-operator
30+
serviceAccountNames:
31+
- ingress-operator

‎credentials-requests/0000_50_cluster-network-operator_02-cncc-credentials.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
apiVersion: cloudcredential.openshift.io/v1
3+
kind: CredentialsRequest
4+
metadata:
5+
annotations:
6+
include.release.openshift.io/ibm-cloud-managed: "true"
7+
include.release.openshift.io/self-managed-high-availability: "true"
8+
include.release.openshift.io/single-node-developer: "true"
9+
name: openshift-cloud-network-config-controller-aws
10+
namespace: openshift-cloud-credential-operator
11+
spec:
12+
providerSpec:
13+
apiVersion: cloudcredential.openshift.io/v1
14+
kind: AWSProviderSpec
15+
statementEntries:
16+
- action:
17+
- ec2:DescribeInstances
18+
- ec2:DescribeInstanceStatus
19+
- ec2:DescribeInstanceTypes
20+
- ec2:UnassignPrivateIpAddresses
21+
- ec2:AssignPrivateIpAddresses
22+
- ec2:UnassignIpv6Addresses
23+
- ec2:AssignIpv6Addresses
24+
- ec2:DescribeSubnets
25+
- ec2:DescribeNetworkInterfaces
26+
effect: Allow
27+
resource: '*'
28+
secretRef:
29+
name: cloud-credentials
30+
namespace: openshift-cloud-network-config-controller
31+
serviceAccountNames:
32+
- cloud-network-config-controller

‎credentials-requests/0000_50_cluster-storage-operator_03_credentials_request_aws.yaml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
---
2+
apiVersion: cloudcredential.openshift.io/v1
3+
kind: CredentialsRequest
4+
metadata:
5+
annotations:
6+
capability.openshift.io/name: Storage
7+
include.release.openshift.io/self-managed-high-availability: "true"
8+
include.release.openshift.io/single-node-developer: "true"
9+
name: aws-ebs-csi-driver-operator
10+
namespace: openshift-cloud-credential-operator
11+
spec:
12+
providerSpec:
13+
apiVersion: cloudcredential.openshift.io/v1
14+
kind: AWSProviderSpec
15+
statementEntries:
16+
- action:
17+
- ec2:AttachVolume
18+
- ec2:CreateSnapshot
19+
- ec2:CreateTags
20+
- ec2:CreateVolume
21+
- ec2:DeleteSnapshot
22+
- ec2:DeleteTags
23+
- ec2:DeleteVolume
24+
- ec2:DescribeInstances
25+
- ec2:DescribeSnapshots
26+
- ec2:DescribeTags
27+
- ec2:DescribeVolumes
28+
- ec2:DescribeVolumesModifications
29+
- ec2:DetachVolume
30+
- ec2:ModifyVolume
31+
- ec2:DescribeAvailabilityZones
32+
- ec2:EnableFastSnapshotRestores
33+
effect: Allow
34+
resource: '*'
35+
- action:
36+
- kms:ReEncrypt*
37+
- kms:Decrypt
38+
- kms:Encrypt
39+
- kms:GenerateDataKey
40+
- kms:GenerateDataKeyWithoutPlainText
41+
- kms:DescribeKey
42+
effect: Allow
43+
resource: '*'
44+
- action:
45+
- kms:RevokeGrant
46+
- kms:CreateGrant
47+
- kms:ListGrants
48+
effect: Allow
49+
policyCondition:
50+
Bool:
51+
kms:GrantIsForAWSResource: true
52+
resource: '*'
53+
secretRef:
54+
name: ebs-cloud-credentials
55+
namespace: openshift-cluster-csi-drivers
56+
serviceAccountNames:
57+
- aws-ebs-csi-driver-operator
58+
- aws-ebs-csi-driver-controller-sa

‎pkg/cli/admin/release/extract.go‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ import (
3232
"github.com/openshift/oc/pkg/cli/image/imagesource"
3333
imagemanifest "github.com/openshift/oc/pkg/cli/image/manifest"
3434
"github.com/openshift/oc/pkg/cli/image/workqueue"
35+
"github.com/openshift/oc/pkg/version"
3536
"github.com/pkg/errors"
3637
)
3738

@@ -94,7 +95,8 @@ func NewExtract(f kcmdutil.Factory, streams genericiooptions.IOStreams) *cobra.C
9495
If --install-config is set, it will be used to determine the expected cluster configuration,
9596
otherwise the command will interrogate your current cluster to determine its configuration.
9697
This command is most accurate when the version of the extracting client matches the version
97-
of the cluster under consideration.
98+
of the cluster under consideration. Otherwise, for example, newly introduced capabilities in
99+
the version of the extracting client might be considered enabled.
98100
99101
Instead of extracting the manifests, you can specify --git=DIR to perform a Git
100102
checkout of the source code that comprises the release. A warning will be printed
@@ -359,10 +361,19 @@ func (o *ExtractOptions) Run(ctx context.Context) error {
359361
if o.Included {
360362
context := "connected cluster"
361363
inclusionConfig := manifestInclusionConfiguration{}
364+
365+
clientVersion, reportedVersion, VersionErr := version.ExtractVersion()
366+
if VersionErr != nil {
367+
return VersionErr
368+
}
369+
if reportedVersion == "" {
370+
reportedVersion = clientVersion.String()
371+
}
372+
362373
if o.InstallConfig == "" {
363-
inclusionConfig, err = findClusterIncludeConfig(ctx, o.RESTConfig)
374+
inclusionConfig, err = findClusterIncludeConfig(ctx, o.RESTConfig, reportedVersion)
364375
} else {
365-
inclusionConfig, err = findClusterIncludeConfigFromInstallConfig(ctx, o.InstallConfig)
376+
inclusionConfig, err = findClusterIncludeConfigFromInstallConfig(ctx, o.InstallConfig, reportedVersion)
366377
context = o.InstallConfig
367378
}
368379
if err != nil {

0 commit comments

Comments
 (0)