OCPBUGS-64822: block upgrades for conflict non-default ClusterImagePolicy resources #5414
Conversation
openshift-merge-robot
added
the
needs-rebase
QiWang19
force-pushed
the
cip-guard-upgrade
branch
from
29527c7 to
8aa4b16
Compare
openshift-merge-robot
removed
the
needs-rebase
QiWang19
changed the title
openshift-ci-robot
added
jira/valid-reference
|
@QiWang19: This pull request references Jira Issue OCPBUGS-64822, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@QiWang19: This pull request references Jira Issue OCPBUGS-64822, which is valid. 7 validation(s) were run on this bug
Requesting review from QA contact: In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/test e2e-aws-ovn-techpreview |
|
@QiWang19: The specified target(s) for The following commands are available to trigger optional jobs: Use In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/payload-job periodic-ci-openshift-release-master-ci-4.20-e2e-aws-ovn-techpreview |
|
@QiWang19: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/cc9c00e0-c0a8-11f0-8b11-4184cda435c8-0 |
QiWang19
force-pushed
the
cip-guard-upgrade
branch
3 times, most recently
from
0ca20b7 to
6203102
Compare
|
/payload-job periodic-ci-openshift-release-master-ci-4.20-e2e-aws-ovn-techpreview |
|
@QiWang19: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/f6a9e450-c0b8-11f0-83d8-cdc5a82ee9c5-0 |
|
/payload-job periodic-ci-openshift-release-master-ci-4.20-e2e-aws-ovn-techpreview |
|
@QiWang19: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/c2505fa0-c3f0-11f0-9f37-7713c0102c8d-0 |
QiWang19
force-pushed
the
cip-guard-upgrade
branch
from
1f06615 to
e285e21
Compare
/retest-required |
|
/payload-job periodic-ci-openshift-release-master-ci-4.20-e2e-aws-ovn-techpreview |
|
@QiWang19: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/2c2720c0-c48d-11f0-8ace-4338ea8bfe20-0 |
|
/payload-job periodic-ci-openshift-release-master-ci-4.20-e2e-aws-ovn-techpreview |
|
@QiWang19: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/1eeb5b10-c57d-11f0-951d-dbe87bf711a7-0 |
Signed-off-by: Qi Wang <qiwan@redhat.com>
QiWang19
force-pushed
the
cip-guard-upgrade
branch
from
e285e21 to
aa13e2d
Compare
|
/payload-job periodic-ci-openshift-release-master-ci-4.20-e2e-aws-ovn-techpreview |
|
@QiWang19: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/2efab780-c71c-11f0-9899-7c55182f5127-0 |
|
@QiWang19: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
openshift-ci-robot
added
the
verified
|
@QiWang19: This PR has been marked as verified by In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
tests passed, we can use SigstoreImageVerificationPKI as an featureset indicator: if it's disabled, the cluster is on Default feature set. |
|
@wking the techpreview job looks good. https://prow.ci.openshift.org/view/gs/test-platform-results/logs/openshift-machine-config-operator-5414-ci-4.20-e2e-aws-ovn-techpreview/1991973383591432192 |
|
I dunno what's going on with bootstrap-unit: But, the job as a whole seems pretty dead, so maybe unrelated to this change? |
wking
left a comment
wking
left a comment
There was a problem hiding this comment.
Testing with a Cluster Bot launch 4.20,openshift/machine-config-operator#5414 aws cluster (logs):
$ curl -s https://raw.githubusercontent.com/openshift/cluster-update-keys/b3cae8f22b51d9062d0ceb6ac9cf2f7651b4ce8f/manifests.rhel/0000_90_openshift-cluster-image-policy.yaml >policy.yaml
$ oc apply -f policy.yaml
$ oc get -o json clusterimagepolicy openshift | jq -r .metadata.creationTimestamp
2025-11-26T23:36:42Z
$ oc get -o json clusteroperator machine-config | jq '.status.conditions[] | select(.type == "Upgradeable")'
{
"lastTransitionTime": "2025-11-26T23:36:44Z",
"message": "ClusterImagePolicy resource named 'openshift' conflicts with the cluster default ClusterImagePolicy object and blocks upgrades. Please delete the 'openshift' ClusterImagePolicy resource and reapply it with a different name if needed",
"reason": "ConflictingClusterImagePolicy",
"status": "False",
"type": "Upgradeable"
}So looks good to me (and only took 2s to notice :) ). Also picks up deletion:
$ oc delete clusterimagepolicy openshift
$ oc get -o json clusteroperator machine-config | jq '.status.conditions[] | select(.type == "Upgradeable")'
{
"lastTransitionTime": "2025-11-26T23:40:06Z",
"reason": "AsExpected",
"status": "True",
"type": "Upgradeable"
}Thanks!
/lgtm
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: QiWang19, wking The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
4 participants
- What I did
- How to verify it
Delete the self created testing clusterimagepolicy, turn on the featuregate, should not have Upgradeable=False guard on openshift internal
openshiftpolicy- Description for the changelog