OCPBUGS-65504: machine-config ClusterOperator relatedObjects missing ClusterRoleBinding - #6369
OCPBUGS-65504: machine-config ClusterOperator relatedObjects missing ClusterRoleBinding#6369eric200428 wants to merge 1 commit into
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
|
@eric200428: This pull request references Jira Issue OCPBUGS-65504, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
Requesting review from QA contact: The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (3)
WalkthroughThe change adds MCO ClusterRoles and ClusterRoleBindings to ClusterOperator related objects in the installation manifest, status synchronization, and initial ClusterOperator creation. A test verifies the expected RBAC resources. ChangesClusterOperator related RBAC status
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@eric200428: This pull request references Jira Issue OCPBUGS-65504, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/test bootstrap-unit |
|
/pipeline required |
|
Scheduling tests matching the |
|
/retest |
|
/test e2e-gcp-op-ocl-part2 |
e543f61 to
b9b675e
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
|
/test bootstrap-unit |
|
/pipeline required |
|
Scheduling tests matching the |
|
/retest-required |
|
Pre-merge tested: Environment setup: Steps:
$ oc get co machine-config
NAME VERSION AVAILABLE PROGRESSING DEGRADED SINCE MESSAGE
machine-config 5.0.0-0-2026-08-12-160525-test-ci-ln-2qm0kt2-latest True False False 54m
$ oc get co machine-config -o json | jq '.status.relatedObjects[] | select(.group=="rbac.authorization.k8s.io") | "\(.resource): \(.name)"' -r | sort
clusterrolebindings: custom-account-openshift-machine-config-operator
clusterrolebindings: machine-config-controller
clusterrolebindings: machine-config-daemon
clusterrolebindings: machine-config-server
clusterrolebindings: machine-os-builder
clusterrolebindings: machine-os-builder-anyuid
clusterrolebindings: system-bootstrap-node-bootstrapper
clusterrolebindings: system-bootstrap-node-renewal
clusterroles: machine-config-controller
clusterroles: machine-config-controller-events
clusterroles: machine-config-daemon
clusterroles: machine-config-daemon-events
clusterroles: machine-config-server
clusterroles: machine-os-builder
clusterroles: machine-os-builder-events
clusterroles: system:openshift:machine-config-operator:cluster-reader
$ oc adm inspect clusteroperator/machine-config --dest-dir=/tmp/mco-inspect
Gathering data for ns/openshift-machine-config-operator...
Gathering data for ns/openshift-kni-infra...
Gathering data for ns/openshift-openstack-infra...
Gathering data for ns/openshift-ovirt-infra...
Gathering data for ns/openshift-vsphere-infra...
Gathering data for ns/openshift-nutanix-infra...
Gathering data for ns/openshift-cloud-platform-infra...
Wrote inspect data to /tmp/mco-inspect.
$ ls /tmp/mco-inspect/cluster-scoped-resources/rbac.authorization.k8s.io/clusterroles/
machine-config-controller-events.yaml
machine-config-controller.yaml
machine-config-daemon-events.yaml
machine-config-daemon.yaml
machine-config-server.yaml
machine-os-builder-events.yaml
machine-os-builder.yaml
system:openshift:machine-config-operator:cluster-reader.yaml
$ ls /tmp/mco-inspect/cluster-scoped-resources/rbac.authorization.k8s.io/clusterrolebindings/
custom-account-openshift-machine-config-operator.yaml
machine-config-controller.yaml
machine-config-daemon.yaml
machine-config-server.yaml
machine-os-builder-anyuid.yaml
machine-os-builder.yaml
system-bootstrap-node-bootstrapper.yaml
system-bootstrap-node-renewal.yaml
$ oc get mcp
NAME CONFIG UPDATED UPDATING DEGRADED MACHINECOUNT READYMACHINECOUNT UPDATEDMACHINECOUNT DEGRADEDMACHINECOUNT AGE
master rendered-master-506eaba3353417853d8d889daf82a225 True False False 3 3 3 0 67m
worker rendered-worker-cbe051d5858d2379867a8526844881ce True False False 3 3 3 0 67m/verified by @umohnani8 and CI |
|
/approve |
|
@umohnani8: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Scheduling tests matching the |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: eric200428, umohnani8 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/retest |
|
/retest-required |
|
/retest-required |
|
@eric200428: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
- What I did
oc adm inspectdoesn't automatically collect them when inspecting a namespace they were silently missing from must gather output.- How to verify it
Unit test:
run
go test ./pkg/operator/and confirm TestSyncRelatedObjectsContainsRBAC passes, which checks that all 8 ClusterRoles and 8 ClusterRoleBindings appear in relatedObjects after syncRelatedObjects() runs.Live Cluster:
oc adm inspect clusteroperator/machine-config --dest-dir=/tmp/mco-inspectls /tmp/mco-inspect/cluster-scoped-resources/rbac.authorization.k8s.io/- Description for the changelog
Add missing MCO ClusterRoles and ClusterRoleBindings to relatedObjects so oc adm inspect collects them
Summary by CodeRabbit