Support Global Operators in Console #326

awgreene · 2022-06-23T19:45:03Z

Problem: Users rely on Copied CSVs in order to understand which
operators are available in a given namespace. When installing All
Namespace operators, a Copied CSV is created in every namespace which
can place a huge performance strain on clusters with many namespaces.
OLM introduced the ability to disable Copied CSVs for All Namespace mode
operators in an effort to resolve the performance issues on large clusters,
unfortunately removing the ability for console to communicate which global
operators are available in a given namespace.

Solution: The protectedCopiedCSVNamespaces runtime flag can be used to
prevent Copied CSVs from being deleted in certain namespaces even when
Copied CSVs are disabled. OLM has been configured to ensure that Copied CSVs
are protected in the openshift namespace. OLM's manifest yaml has also been
updated to provide authenticated users with the RBAC to view CSVs in the
openshift namespace, which console can then use to communicate which operators
are available globally.

openshift-ci · 2022-06-23T19:45:26Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

openshift-ci · 2022-06-23T19:45:54Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: awgreene

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [awgreene]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Problem: Users rely on Copied CSVs in order to understand which operators are available in a given namespace. When installing All Namespace operators, a Copied CSV is created in every namespace which can place a huge performance strain on clusters with many namespaces. OLM introduced the ability to disable Copied CSVs for All Namespace mode operators in an effort to resolve the performance issues on large clusters, unfortunately removing the ability for users to identify which operators are available in a given namespace. Solution: The protectedCopiedCSVNamespaces runtime flag can be used to prevent Copied CSVs from being deleted even when Copied CSVs are disabled. An admin can then provide users with the proper RBAC to view which operators are running in All Namespace mode. Signed-off-by: Alexander Greene <[email protected]> Upstream-repository: operator-lifecycle-manager Upstream-commit: 6c4e779554c892494921c1bc9a00ba547cb6a431

Problem: After disabling Copied CSVs, the openshift console can no longer communicate to users which operators are available globally across the cluster. Solution: Configure OLM to ensure that Copied CSVs for operators scoped to All Namespaces appear in the openshift namespace. Update the OLM manifests to include RBAC for authenticated users to view CSVs in this namespace.

timflannagan · 2022-07-26T00:00:49Z

/test all

awgreene · 2022-07-26T16:09:50Z

/retest

timflannagan

I'm looking at the second commit changes, and I just want to make sure I'm understanding it correctly:

            - --protectedCopiedCSVNamespaces
            - openshift

Is "openshift" the right value here, or do we need to specify something like "openshift-operators", "openshift-console", etc.?

tylerslaton · 2022-07-27T18:54:31Z

/retest

timflannagan · 2022-07-28T19:53:32Z

manifests/0000_50_olm_15-csv-viewer.rbac.yaml

+subjects:
+  - apiGroup: rbac.authorization.k8s.io
+    kind: Group
+    name: system:authenticated


It looks like this might be related to the CI failures:

{ fail [github.com/openshift/origin/test/extended/authorization/rbac/groups_default_rules.go:232]: Jul 27 20:24:39.743: system:authenticated has extra permissions in namespace "openshift": {APIGroups:["operators.coreos.com"], Resources:["clusterserviceversions"], Verbs:["get" "list" "watch"]} Ginkgo exit error 1: exit with code 1}

I've opened openshift/origin#27326 to address this.

Note: The PR that Alex had linked is now merged. Looking at the e2e-gcp check, it looks like those changes worked, and we're back in business.

timflannagan · 2022-07-28T20:24:01Z

/hold

awgreene · 2022-07-28T20:30:28Z

scripts/olm-deployment.patch.yaml

+- command: update
+  path: spec.template.spec.containers[0].args[+]
+  value:
+    --protectedCopiedCSVNamespaces
+- command: update
+  path: spec.template.spec.containers[0].args[+]
+  value:
+    openshift


I kept hitting formatting errors when attempting to add 2 lines to the array with a single update command, if anyone knows how to do this in a single update please chime in.

timflannagan · 2022-08-04T13:39:14Z

/test all

timflannagan · 2022-08-04T16:26:24Z

/test unit-olm

exdx · 2022-08-04T16:35:29Z

staging/operator-lifecycle-manager/pkg/controller/operators/olm/operator.go

 		}

 		csvs, err := a.lister.OperatorsV1alpha1().ClusterServiceVersionLister().ClusterServiceVersions(og.GetNamespace()).List(labels.NewSelector().Add(*nonCopiedCSVRequirement))
 		if err != nil {
 			return err
 		}

+		namespaces, err := a.lister.CoreV1().NamespaceLister().List(labels.Everything())


This List() might be quite expensive. Is there an implementation where we don't rely on knowing all namespaces on the cluster, just the ones that are in the flag?

Oh wait, it's hitting the cache. This is likely fine then.

openshift-ci · 2022-08-04T16:46:26Z

@awgreene: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-gcp-olm-flaky	`c2ec825`	link	false	`/test e2e-gcp-olm-flaky`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

timflannagan · 2022-08-04T16:52:48Z

/lgtm
/hold cancel

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 23, 2022

openshift-ci bot requested review from gallettilance and njhale June 23, 2022 19:45

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 23, 2022

awgreene force-pushed the disabled-copied-csv-console-bug branch from 5b3a8cf to 6b51648 Compare July 25, 2022 20:03

awgreene added 2 commits July 25, 2022 13:40

awgreene force-pushed the disabled-copied-csv-console-bug branch from 6b51648 to c2ec825 Compare July 25, 2022 20:44

awgreene changed the title ~~add manifests~~ Support Global Operators in Console Jul 25, 2022

awgreene marked this pull request as ready for review July 26, 2022 16:11

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 26, 2022

openshift-ci bot requested review from dinhxuanvu and exdx and removed request for njhale July 26, 2022 16:11

timflannagan reviewed Jul 26, 2022

View reviewed changes

timflannagan mentioned this pull request Jul 26, 2022

Sync 07/26 #343

Merged

timflannagan reviewed Jul 28, 2022

View reviewed changes

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 28, 2022

awgreene commented Jul 28, 2022

View reviewed changes

awgreene mentioned this pull request Aug 2, 2022

Update authenticated users RBAC e2e test openshift/origin#27326

Merged

exdx reviewed Aug 4, 2022

View reviewed changes

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 4, 2022

openshift-ci bot assigned timflannagan Aug 4, 2022

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Aug 4, 2022

openshift-ci bot merged commit eb1026a into openshift:master Aug 4, 2022

Support Global Operators in Console #326

Support Global Operators in Console #326

Uh oh!

Conversation

awgreene commented Jun 23, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci bot commented Jun 23, 2022

Uh oh!

openshift-ci bot commented Jun 23, 2022

Uh oh!

timflannagan commented Jul 26, 2022

Uh oh!

awgreene commented Jul 26, 2022

Uh oh!

timflannagan left a comment

Choose a reason for hiding this comment

Uh oh!

tylerslaton commented Jul 27, 2022

Uh oh!

timflannagan Jul 28, 2022

Choose a reason for hiding this comment

Uh oh!

awgreene Jul 28, 2022

Choose a reason for hiding this comment

Uh oh!

timflannagan Aug 4, 2022

Choose a reason for hiding this comment

Uh oh!

timflannagan commented Jul 28, 2022

Uh oh!

awgreene Jul 28, 2022

Choose a reason for hiding this comment

Uh oh!

timflannagan commented Aug 4, 2022

Uh oh!

timflannagan commented Aug 4, 2022

Uh oh!

exdx Aug 4, 2022

Choose a reason for hiding this comment

Uh oh!

exdx Aug 4, 2022

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Aug 4, 2022

Uh oh!

timflannagan commented Aug 4, 2022

Uh oh!

Uh oh!

awgreene commented Jun 23, 2022 •

edited

Loading