OCPBUGS-43966, OCPBUGS-57222: Synchronize From Upstream Repositories

staging/operator-lifecycle-manager/.github/workflows/go-verdiff.yaml

@@ -10,8 +10,16 @@ jobs:
   go-verdiff:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Check golang version
-        run: hack/tools/check-go-version.sh "${{ github.event.pull_request.base.sha }}"
+    - uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: Check golang version
+      run: |
+        export LABELS="$(gh api repos/$OWNER/$REPO/pulls/$PR --jq '.labels.[].name')"
+        hack/tools/check-go-version.sh -b "${{ github.event.pull_request.base.sha }}"
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+        OWNER: ${{ github.repository_owner }}
+        REPO: ${{ github.event.repository.name }}
+        PR: ${{ github.event.pull_request.number }}

staging/operator-lifecycle-manager/hack/tools/check-go-version.sh

@@ -17,9 +17,40 @@
 # this implementation in the future.
 ###########################################
 
+U_FLAG='false'
+B_FLAG=''
 
-BASE_REF=${1:-main}
-GO_VER=$(sed -En 's/^go (.*)$/\1/p' "go.mod")
+usage() {
+    cat <<EOF
+Usage:
+  $0 [-b <git-ref>] [-h] [-u]
+
+Reports on golang mod file version updates, returns an error when a go.mod
+file exceeds the root go.mod file (used as a threshold).
+
+Options:
+  -b <git-ref>  git reference (branch or SHA) to use as a baseline.
+                Defaults to 'main'.
+  -h            Help (this text).
+  -u            Error on any update, even below the threshold.
+EOF
+}
+
+while getopts 'b:hu' f; do
+    case "${f}" in
+        b) B_FLAG="${OPTARG}" ;;
+        h) usage
+           exit 0 ;;
+        u) U_FLAG='true' ;;
+        *) echo "Unknown flag ${f}"
+           usage
+           exit 1 ;;
+    esac
+done
+
+BASE_REF=${B_FLAG:-main}
+ROOT_GO_MOD="./go.mod"
+GO_VER=$(sed -En 's/^go (.*)$/\1/p' "${ROOT_GO_MOD}")
 OLDIFS="${IFS}"
 IFS='.' MAX_VER=(${GO_VER})
 IFS="${OLDIFS}"
@@ -32,6 +63,7 @@ fi
 GO_MAJOR=${MAX_VER[0]}
 GO_MINOR=${MAX_VER[1]}
 GO_PATCH=${MAX_VER[2]}
+OVERRIDE_LABEL="override-go-verdiff"
 
 RETCODE=0
 
@@ -90,9 +122,32 @@ for f in $(find . -name "*.mod"); do
         continue
     fi
     if [ "${new}" != "${old}" ]; then
-        echo "${f}: ${v}: Updated golang version from ${old}"
-        RETCODE=1
+        # We NEED to report on changes in the root go.mod, regardless of the U_FLAG
+        if [ "${f}" == "${ROOT_GO_MOD}" ]; then
+            echo "${f}: ${v}: Updated ROOT golang version from ${old}"
+            RETCODE=1
+            continue
+        fi
+        if ${U_FLAG}; then
+            echo "${f}: ${v}: Updated golang version from ${old}"
+            RETCODE=1
+        fi
+    fi
+done
+
+for l in ${LABELS}; do
+    if [ "$l" == "${OVERRIDE_LABEL}" ]; then
+        if [ ${RETCODE} -eq 1 ]; then
+            echo ""
+            echo "Found ${OVERRIDE_LABEL} label, overriding failed results."
+            RETCODE=0
+        fi
     fi
 done
 
+if [ ${RETCODE} -eq 1 ]; then
+    echo ""
+    echo "This test result may be overridden by applying the (${OVERRIDE_LABEL}) label to this PR and re-running the CI job."
+fi
+
 exit ${RETCODE}

staging/operator-lifecycle-manager/pkg/controller/operators/olm/operatorgroup.go

@@ -19,6 +19,7 @@ import (
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/errors"
+	"k8s.io/apimachinery/pkg/util/sets"
 
 	operatorsv1 "github.com/operator-framework/api/pkg/operators/v1"
 	"github.com/operator-framework/api/pkg/operators/v1alpha1"
@@ -1047,24 +1048,35 @@ func (a *Operator) ensureOpGroupClusterRole(op *operatorsv1.OperatorGroup, suffi
 }
 
 func (a *Operator) getClusterRoleAggregationRule(apis cache.APISet, suffix string) (*rbacv1.AggregationRule, error) {
-	var selectors []metav1.LabelSelector
+	if len(apis) == 0 {
+		return nil, nil
+	}
+
+	aggregationLabels := sets.New[string]()
 	for api := range apis {
 		aggregationLabel, err := aggregationLabelFromAPIKey(api, suffix)
 		if err != nil {
 			return nil, err
 		}
+		aggregationLabels.Insert(aggregationLabel)
+	}
+
+	// The order of the resulting selectors MUST BE deterministic in order
+	// to avoid unnecessary writes against the API server where only the order
+	// is changing. Therefore, we use `sets.List` to iterate. It returns a
+	// sorted slice of the aggregation labels.
+	selectors := make([]metav1.LabelSelector, 0, aggregationLabels.Len())
+	for _, aggregationLabel := range sets.List(aggregationLabels) {
 		selectors = append(selectors, metav1.LabelSelector{
 			MatchLabels: map[string]string{
 				aggregationLabel: "true",
 			},
 		})
 	}
-	if len(selectors) > 0 {
-		return &rbacv1.AggregationRule{
-			ClusterRoleSelectors: selectors,
-		}, nil
-	}
-	return nil, nil
+
+	return &rbacv1.AggregationRule{
+		ClusterRoleSelectors: selectors,
+	}, nil
 }
 
 func (a *Operator) ensureOpGroupClusterRoles(op *operatorsv1.OperatorGroup, apis cache.APISet) error {

staging/operator-lifecycle-manager/pkg/controller/operators/olm/operatorgroup_test.go

@@ -8,15 +8,17 @@ import (
 	"github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"k8s.io/client-go/metadata/metadatalister"
-
+	rbacv1 "k8s.io/api/rbac/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/metadata/metadatalister"
 	ktesting "k8s.io/client-go/testing"
 
 	"github.com/operator-framework/api/pkg/operators/v1alpha1"
 	"github.com/operator-framework/operator-lifecycle-manager/pkg/api/client/clientset/versioned/fake"
+	"github.com/operator-framework/operator-lifecycle-manager/pkg/controller/registry/resolver/cache"
+	"github.com/operator-framework/operator-registry/pkg/registry"
 )
 
 func TestCopyToNamespace(t *testing.T) {
@@ -407,3 +409,65 @@ func TestCSVCopyPrototype(t *testing.T) {
 		},
 	}, dst)
 }
+
+func TestOperator_getClusterRoleAggregationRule(t *testing.T) {
+	tests := []struct {
+		name    string
+		apis    cache.APISet
+		suffix  string
+		want    func(*testing.T, *rbacv1.AggregationRule)
+		wantErr require.ErrorAssertionFunc
+	}{
+		{
+			name:   "no aggregation rule when no APIs",
+			apis:   cache.APISet{},
+			suffix: "admin",
+			want: func(t *testing.T, rule *rbacv1.AggregationRule) {
+				require.Nil(t, rule)
+			},
+			wantErr: require.NoError,
+		},
+		{
+			name: "ordered selectors in aggregation rule",
+			apis: cache.APISet{
+				registry.APIKey{Group: "example.com", Version: "v1alpha1", Kind: "Foo"}: {},
+				registry.APIKey{Group: "example.com", Version: "v1alpha2", Kind: "Foo"}: {},
+				registry.APIKey{Group: "example.com", Version: "v1alpha3", Kind: "Foo"}: {},
+				registry.APIKey{Group: "example.com", Version: "v1alpha4", Kind: "Foo"}: {},
+				registry.APIKey{Group: "example.com", Version: "v1alpha5", Kind: "Foo"}: {},
+				registry.APIKey{Group: "example.com", Version: "v1alpha1", Kind: "Bar"}: {},
+				registry.APIKey{Group: "example.com", Version: "v1alpha2", Kind: "Bar"}: {},
+				registry.APIKey{Group: "example.com", Version: "v1alpha3", Kind: "Bar"}: {},
+				registry.APIKey{Group: "example.com", Version: "v1alpha4", Kind: "Bar"}: {},
+				registry.APIKey{Group: "example.com", Version: "v1alpha5", Kind: "Bar"}: {},
+			},
+			suffix: "admin",
+			want: func(t *testing.T, rule *rbacv1.AggregationRule) {
+				getOneKey := func(t *testing.T, m map[string]string) string {
+					require.Len(t, m, 1)
+					for k := range m {
+						return k
+					}
+					t.Fatalf("no keys found in map")
+					return ""
+				}
+
+				a := getOneKey(t, rule.ClusterRoleSelectors[0].MatchLabels)
+				for _, selector := range rule.ClusterRoleSelectors[1:] {
+					b := getOneKey(t, selector.MatchLabels)
+					require.Lessf(t, a, b, "expected selector match labels keys to be in sorted ascending order")
+					a = b
+				}
+			},
+			wantErr: require.NoError,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			a := &Operator{}
+			got, err := a.getClusterRoleAggregationRule(tt.apis, tt.suffix)
+			tt.wantErr(t, err)
+			tt.want(t, got)
+		})
+	}
+}

staging/operator-lifecycle-manager/pkg/controller/registry/resolver/source_registry.go

@@ -75,14 +75,16 @@ type RegistrySourceProvider struct {
 	invalidator  *sourceInvalidator
 }
 
+const defaultCacheLifetime time.Duration = 30 * time.Minute
+
 func SourceProviderFromRegistryClientProvider(rcp RegistryClientProvider, catsrcLister v1alpha1listers.CatalogSourceLister, logger logrus.StdLogger) *RegistrySourceProvider {
 	return &RegistrySourceProvider{
 		rcp:          rcp,
 		logger:       logger,
 		catsrcLister: catsrcLister,
 		invalidator: &sourceInvalidator{
 			validChans: make(map[cache.SourceKey]chan struct{}),
-			ttl:        5 * time.Minute,
+			ttl:        defaultCacheLifetime,
 		},
 	}
 }