Sync 07/26

[timflannagan]

Downstream sync for the registry + API repositories. I excluded upstream OLM from this sync given it's just a single commit that requires explicit manifests changes, and we can tackle that in #326 after this lands.

Also includes the upstream OLM ginkgo v2 commit that was previously added to downstream's denylist of commits. I updated some of the downstream documentation, and silenced the markdown linting violations that were popping up in my local IDE.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: timflannagan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [timflannagan]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[timflannagan]

/test unit-api

[timflannagan]

The API unit tests are passing for me locally:

--- FAIL: Test_RunManifestInspect (0.00s)
    --- FAIL: Test_RunManifestInspect/should_return_the_data_from_the_manifest (0.00s)
        multiarch_test.go:255: runManifestInspect() error = docker pull quay.io/operator-framework/opm:latest failed with error: (exec: "docker": executable file not found in $PATH) , wantErr false

This seems like a potentially problematic test.

[timflannagan]

The OLM e2e tests were failing as the ginkgo v2 commit still had ginkgo v1 and v2 modules as direct dependencies, which produced a panic when running in CI and local environments. It looks like this was because we merged some bug fixes during feature and code freeze, so there was some slight skew. I ended up just manually editing those files, and attaching them to the original upstream commit to appease the verify-commits Makefile check.

Removed the o-f/api commit that was producing unit test failures from this PR, and added to that repository's denylist commits. It doesn't feel like we need that to directly live in downstream OLM, at least in the short term, and we can re-evaluate whether that was the right approach over time. I ran the sync automation locally to verify that the api denylist works properly, and zero commits were found, so it looks like covered on that front too.

[timflannagan]

/retest

[timflannagan]

It looks like there's no "oc" binary in the e2e test container? Weird.

[timflannagan]

[AfterEach] Subscription
/go/src/github.com/openshift/operator-framework-olm/staging/operator-lifecycle-manager/test/e2e/subscription_e2e_test.go:63
collecting the subscription-e2e-gjhts namespace artifacts as the 'choose the dependent package from the catsrc in the same namespace as the installing operator' test case failed
collecting logs in the /logs/artifacts artifacts directory
unable to determine kubeconfig path so defaulting to the $KUBECONFIG value
failed to collect namespace artifacts: exit status 127
tearing down the subscription-e2e-gjhts namespace
resetting e2e kube client
deleting subscription-e2e-gjhts/subscription-e2e-gjhts-operatorgroup
deleting <global>/subscription-e2e-gjhts
garbage collecting CRDs
<< End Captured GinkgoWriter Output
Unexpected error:
<*errors.errorString | 0xc00024e0b0>: {
s: "timed out waiting for the condition",
}
timed out waiting for the condition
occurred
In [BeforeEach] at: /go/src/github.com/openshift/operator-framework-olm/staging/operator-lifecycle-manager/test/e2e/subscription_e2e_test.go:1904
Full Stack Trace
github.com/operator-framework/operator-lifecycle-manager/test/e2e.glob..func25.17.5.1()
/go/src/github.com/openshift/operator-framework-olm/staging/operator-lifecycle-manager/test/e2e/subscription_e2e_test.go:1904 +0x12e9

[timflannagan]

It looks like kubectl is present downstream:

sh-4.4$ oc
sh: oc: command not found
sh-4.4$ kubectl

[timflannagan]

And more fun in the catalog-operator container logs:

E0727 17:16:13.142754       1 queueinformer_operator.go:290] sync {"update" "subscription-e2e-k5mx2/catsrcdrr9q"} failed: couldn't ensure registry server - error ensuring pod: : error creating new pod: catsrcdrr9q-: pods "catsrcdrr9q-tl9kh" is forbidden: violates PodSecurity "restricted:v1.24": allowPrivilegeEscalation != false (container "configmap-registry-server" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "configmap-registry-server" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "configmap-registry-server" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "configmap-registry-server" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

[tylerslaton]

/retest

[timflannagan]

/hold

[timflannagan]

/retest-required

[timflannagan]

/test ci/prow/e2e-gcp-olm

[openshift-ci]

@timflannagan: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

• /test e2e-gcp
• /test e2e-gcp-console-olm
• /test e2e-gcp-olm
• /test e2e-upgrade
• /test images
• /test unit-api
• /test unit-olm
• /test unit-psm
• /test unit-registry
• /test verify

The following commands are available to trigger optional jobs:

• /test e2e-gcp-olm-flaky

Use /test all to run all jobs.

In response to this:

/test ci/prow/e2e-gcp-olm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[timflannagan]

The in-flight e2e-gcp-olm is going to fail after poking around the build cluster's console.

/test e2e-gcp-olm

[timflannagan]

I cherry-picked the upstream registry ginkgo bump PR, and bumped the root tools.go ginkgo module version so now the root module uses ginkgo v2 for all the staging components.

[timflannagan]

/retest

[timflannagan]

/hold cancel

[timflannagan]

The upgrade test previously passed but ran into some infra issues. Overriding it in the meantime to try and squeeze this in before the PSA policy changes are re-reverted.

/override ci/prow/e2e-upgrade

[openshift-ci]

@timflannagan: Overrode contexts on behalf of timflannagan: ci/prow/e2e-upgrade

In response to this:

The upgrade test previously passed but ran into some infra issues. Overriding it in the meantime to try and squeeze this in before the PSA policy changes are re-reverted.

/override ci/prow/e2e-upgrade

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[tylerslaton]

/lgtm

[openshift-ci]

@timflannagan: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-gcp-olm-flaky	c8ae912	link	false	/test e2e-gcp-olm-flaky

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.