diff --git a/go.mod b/go.mod index fe0d515c71..92a0e7ac25 100644 --- a/go.mod +++ b/go.mod @@ -14,7 +14,7 @@ require ( github.com/openshift/api v0.0.0-20260805215214-cfb63858e9d7 github.com/openshift/build-machinery-go v0.0.0-20251023084048-5d77c1a5e5af github.com/openshift/client-go v0.0.0-20260806041845-b74fb348f1e7 - github.com/openshift/library-go v0.0.0-20260902083006-63bdbfb4da6b + github.com/openshift/library-go v0.0.0-20260904093542-946ee696bcb5 github.com/openshift/multi-operator-manager v0.0.0-20241205181422-20aa3906b99d github.com/openshift/oauth-apiserver v0.0.0-20260520145010-97a820bd5412 github.com/spf13/cobra v1.10.2 diff --git a/go.sum b/go.sum index be4d138320..28cd2ee200 100644 --- a/go.sum +++ b/go.sum @@ -173,8 +173,8 @@ github.com/openshift/build-machinery-go v0.0.0-20251023084048-5d77c1a5e5af h1:Ui github.com/openshift/build-machinery-go v0.0.0-20251023084048-5d77c1a5e5af/go.mod h1:8jcm8UPtg2mCAsxfqKil1xrmRMI3a+XU2TZ9fF8A7TE= github.com/openshift/client-go v0.0.0-20260806041845-b74fb348f1e7 h1:Lphm0uMAyM26ibbOca0+dg7uLz7GmmrIdeWjzOh5R/U= github.com/openshift/client-go v0.0.0-20260806041845-b74fb348f1e7/go.mod h1:u08LcpI8Hq3IpelQLbciGRa/P158cE/O3uQe2Bt3Roo= -github.com/openshift/library-go v0.0.0-20260902083006-63bdbfb4da6b h1:riOGVaqdHIzGYoFtWYPXmtcnBnn3/xgU2r3YkDhIVBQ= -github.com/openshift/library-go v0.0.0-20260902083006-63bdbfb4da6b/go.mod h1:pH7rnNOj3dJpdpBtE32LB2pAg0AYDIaaBJJrFxX2pPY= +github.com/openshift/library-go v0.0.0-20260904093542-946ee696bcb5 h1:Xxq4yPrGXwYoX02ggkqImBlojBq5cZmJer8uSySdNHc= +github.com/openshift/library-go v0.0.0-20260904093542-946ee696bcb5/go.mod h1:pH7rnNOj3dJpdpBtE32LB2pAg0AYDIaaBJJrFxX2pPY= github.com/openshift/multi-operator-manager v0.0.0-20241205181422-20aa3906b99d h1:Rzx23P63JFNNz5D23ubhC0FCN5rK8CeJhKcq5QKcdyU= github.com/openshift/multi-operator-manager v0.0.0-20241205181422-20aa3906b99d/go.mod h1:iVi9Bopa5cLhjG5ie9DoZVVqkH8BGb1FQVTtecOLn4I= github.com/openshift/oauth-apiserver v0.0.0-20260520145010-97a820bd5412 h1:oDB0GmUXLp8y85fWz+LGRE0hM5JqbXTfNPi5GjEqiX0= diff --git a/vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/kms_preflight_controller.go b/vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/kms_preflight_controller.go index de2a4f5cf9..0d60ca86dd 100644 --- a/vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/kms_preflight_controller.go +++ b/vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/kms_preflight_controller.go @@ -156,11 +156,6 @@ func (h *kmsConfigHasher) hashReferencedConfigMap(ctx context.Context, hasher ha // Pod readiness gate condition types set by the preflight checker running inside // the pod. The checker PATCHes its own pod status with these conditions. const ( - // KMSPreflightConfigHashPodCondition carries the config hash the pod was - // deployed for. The controller compares this against the required hash to - // detect stale pods from a previous config. - KMSPreflightConfigHashPodCondition corev1.PodConditionType = "KMSPreflightConfigHash" - // KMSPreflightResultPodCondition carries the outcome of the preflight check. // Status True means the check passed; False means it failed, with details // in the condition message. @@ -426,21 +421,16 @@ func (c *kmsPreflightController) sync(ctx context.Context, syncCtx factory.SyncC // degraded and keep the pod for inspection. The admin fixes the config, // which triggers a new hash and cleanup via scenario (a). // -// c) Deployed hash matches, no KMSPreflightConfigHash condition yet — the -// checker has not started reporting. If the pod phase is Succeeded, it -// exited without reporting; return an error. Otherwise requeue and wait. -// If the pod has exceeded the startup timeout (3m) without reporting, -// return an error with the reason the pod is stuck. -// -// d) Hash matches, no KMSPreflightResult yet — check is running. -// If the pod phase is Succeeded, it exited without reporting the -// result; return an error. Otherwise requeue and wait. If past -// the startup timeout, return an error with the stuck reason. +// c) Deployed hash matches, no KMSPreflightResult yet — the check is still +// running. If the pod phase is Succeeded, it exited without reporting; +// return an error. Otherwise requeue and wait. If the pod has exceeded +// the startup timeout (3m) without reporting, return an error with the +// reason the pod is stuck (e.g. ImagePullBackOff, Pending). // -// e) Hash matches, KMSPreflightResult is True — check passed. +// d) Hash matches, KMSPreflightResult is True — check passed. // Clean up the pod immediately. // -// f) Hash matches, KMSPreflightResult is False — check failed. Report +// e) Hash matches, KMSPreflightResult is False — check failed. Report // degraded with the failure message. Keep the pod for inspection. // The admin fixes the config, which triggers a new hash and cleanup // via scenario (a). @@ -449,9 +439,9 @@ func (c *kmsPreflightController) sync(ctx context.Context, syncCtx factory.SyncC // to completion; infrastructure failures are surfaced through the degraded // condition only: // -// - 3e (check passed): writes Result{Succeeded, configHash, remoteKeyID} -// - 3f (check failed): writes Result{Failed, configHash, remoteKeyID}; EncryptionKMSPreflightControllerDegraded is also set -// - 3b, 3c, 3d (infrastructure failures): no write; EncryptionKMSPreflightControllerDegraded is set instead +// - 3d (check passed): writes Result{Succeeded, configHash, remoteKeyID} +// - 3e (check failed): writes Result{Failed, configHash, remoteKeyID}; EncryptionKMSPreflightControllerDegraded is also set +// - 3b, 3c (infrastructure failures): no write; EncryptionKMSPreflightControllerDegraded is set instead // // Condition matrix: // @@ -469,15 +459,12 @@ func (c *kmsPreflightController) sync(ctx context.Context, syncCtx factory.SyncC // 3a Stale pod — Cleanup success true nil False True No // 3a Stale pod — Cleanup error true err True False No // 3b Pod Failed — keep for inspection false *pe True False Yes -// 3c No hash, pod Running, no timeout true nil False True No -// 3c No hash, timeout exceeded true *pe True False Yes -// 3c No hash, pod Succeeded without reporting false *pe True False Yes -// 3d Hash matches, no result, pod Running, no timeout true nil False True No -// 3d Hash matches, no result, timeout exceeded true *pe True False Yes -// 3d Hash matches, no result, pod Succeeded false *pe True False Yes -// 3e Check passed — write result + Cleanup, success false nil False False No -// 3e Check passed — write result fails false err True False No -// 3f Check failed — write result + keep pod false *pe True False Yes +// 3c No result, pod Running, no timeout true nil False True No +// 3c No result, timeout exceeded true *pe True False Yes +// 3c No result, pod Succeeded without reporting false *pe True False Yes +// 3d Check passed — write result + Cleanup, success false nil False False No +// 3d Check passed — write result fails false err True False No +// 3e Check failed — write result + keep pod false *pe True False Yes // // TODO: in the future we might want to add retries for failed preflights. func (c *kmsPreflightController) runPreflightChecks(ctx context.Context) (requeue bool, progressReason, progressMessage string, err error) { @@ -545,19 +532,9 @@ func (c *kmsPreflightController) runPreflightChecks(ctx context.Context) (requeu return false, "", "", pe } - // Scenario 3c: pod has not reported its config hash yet. - hashCondition := FindPodCondition(podStatus.Conditions, KMSPreflightConfigHashPodCondition) - if hashCondition == nil { - if podStatus.Phase == corev1.PodSucceeded { - return false, "", "", &preflightError{reason: "PodCompletedWithoutResult", message: fmt.Sprintf("preflight pod completed without reporting result for hash %s", requiredHash)} - } - if pe := podStartupTimeoutError(podStatus, "preflight pod has not reported config hash"); pe != nil { - return true, "", "", pe - } - return true, "RunningPreflightCheck", fmt.Sprintf("Waiting for preflight pod to report config hash for %s", requiredHash), nil - } - - // Scenario 3d: hash matches, waiting for result. + // Scenario 3c: pod has not reported its result yet. The checker writes its + // result condition once the check completes, so its absence means the check + // is still running (or the pod is stuck before it could run). resultCondition := FindPodCondition(podStatus.Conditions, KMSPreflightResultPodCondition) if resultCondition == nil { if podStatus.Phase == corev1.PodSucceeded { @@ -574,7 +551,7 @@ func (c *kmsPreflightController) runPreflightChecks(ctx context.Context) (requeu remoteKeyID = kc.Message } - // Scenario 3e: check passed. + // Scenario 3d: check passed. if resultCondition.Status == corev1.ConditionTrue { if err := c.ensurePreflightResult(ctx, existingResult, operatorv1.KMSPreflightResult{ Status: operatorv1.KMSPreflightResultSucceeded, @@ -586,7 +563,7 @@ func (c *kmsPreflightController) runPreflightChecks(ctx context.Context) (requeu return false, "", "", c.cleanupDeployer(ctx) } - // Scenario 3f: check failed. Keep pod for inspection; the admin will + // Scenario 3e: check failed. Keep pod for inspection; the admin will // update the config which triggers a new hash and cleanup via scenario 3a. pe := &preflightError{ reason: "PreflightCheckFailed", diff --git a/vendor/github.com/openshift/library-go/pkg/operator/encryption/kms/preflight/always_succeed_deployer.go b/vendor/github.com/openshift/library-go/pkg/operator/encryption/kms/preflight/always_succeed_deployer.go deleted file mode 100644 index 5d23dad0ea..0000000000 --- a/vendor/github.com/openshift/library-go/pkg/operator/encryption/kms/preflight/always_succeed_deployer.go +++ /dev/null @@ -1,62 +0,0 @@ -package preflight - -import ( - "context" - - corev1 "k8s.io/api/core/v1" - apierrors "k8s.io/apimachinery/pkg/api/errors" - "k8s.io/apimachinery/pkg/runtime/schema" - - "github.com/openshift/library-go/pkg/operator/encryption/controllers" -) - -// NewAlwaysSucceedKMSPreflightDeployer returns a KMSPreflightDeployer that -// always reports a successful preflight without running any real check. -// Use as a temporary stand-in until a real pod-based deployer is available. -func NewAlwaysSucceedKMSPreflightDeployer() *AlwaysSucceedKMSPreflightDeployer { - return &AlwaysSucceedKMSPreflightDeployer{} -} - -// AlwaysSucceedKMSPreflightDeployer is a KMSPreflightDeployer that immediately -// reports a successful preflight result without deploying any workload. -type AlwaysSucceedKMSPreflightDeployer struct { - configHash string - deployed bool -} - -func (d *AlwaysSucceedKMSPreflightDeployer) Deploy(_ context.Context, configHash string, _ *corev1.Secret) error { - d.configHash = configHash - d.deployed = true - return nil -} - -func (d *AlwaysSucceedKMSPreflightDeployer) Status(_ context.Context) (string, corev1.PodStatus, error) { - if !d.deployed { - return "", corev1.PodStatus{}, apierrors.NewNotFound(schema.GroupResource{Resource: "pods"}, "kms-preflight") - } - return d.configHash, corev1.PodStatus{ - Phase: corev1.PodSucceeded, - Conditions: []corev1.PodCondition{ - { - Type: controllers.KMSPreflightConfigHashPodCondition, - Status: corev1.ConditionTrue, - Message: d.configHash, - }, - { - Type: controllers.KMSPreflightResultPodCondition, - Status: corev1.ConditionTrue, - }, - { - Type: controllers.KMSPreflightRemoteKeyIDPodCondition, - Status: corev1.ConditionTrue, - Message: "always-succeed", - }, - }, - }, nil -} - -func (d *AlwaysSucceedKMSPreflightDeployer) Cleanup(_ context.Context) error { - d.configHash = "" - d.deployed = false - return nil -} diff --git a/vendor/github.com/openshift/library-go/pkg/operator/encryption/kms/preflight/assets/kms-preflight-pod.yaml b/vendor/github.com/openshift/library-go/pkg/operator/encryption/kms/preflight/assets/kms-preflight-pod.yaml index 3600a2ba3c..ff88ce4140 100644 --- a/vendor/github.com/openshift/library-go/pkg/operator/encryption/kms/preflight/assets/kms-preflight-pod.yaml +++ b/vendor/github.com/openshift/library-go/pkg/operator/encryption/kms/preflight/assets/kms-preflight-pod.yaml @@ -33,7 +33,6 @@ spec: command: [{{.Command}}] args: - --kms-call-timeout={{.KMSCallTimeout}} - - --config-hash=$(CONFIG_HASH) - --pod-name=$(POD_NAME) - --pod-namespace=$(POD_NAMESPACE) env: @@ -41,8 +40,6 @@ spec: valueFrom: { fieldRef: { fieldPath: metadata.name } } - name: POD_NAMESPACE valueFrom: { fieldRef: { fieldPath: metadata.namespace } } - - name: CONFIG_HASH - value: {{.ConfigHash}} # TODO: figure out good resource request values. resources: requests: diff --git a/vendor/github.com/openshift/library-go/pkg/operator/encryption/kms/preflight/cmd.go b/vendor/github.com/openshift/library-go/pkg/operator/encryption/kms/preflight/cmd.go index 0437ffce8a..eac320ef3a 100644 --- a/vendor/github.com/openshift/library-go/pkg/operator/encryption/kms/preflight/cmd.go +++ b/vendor/github.com/openshift/library-go/pkg/operator/encryption/kms/preflight/cmd.go @@ -26,7 +26,6 @@ type options struct { kmsCallTimeout time.Duration podName string podNamespace string - configHash string kubeconfig string } @@ -52,7 +51,6 @@ func NewCommand(ctx context.Context) *cobra.Command { func (o *options) addFlags(fs *pflag.FlagSet) { fs.StringSliceVar(&o.kmsSockets, "kms-sockets", nil, "KMS plugin endpoints in unix:// URI format (e.g. unix:///var/run/kmsplugin/kms-1.sock); the first socket receives full verification (Status + Encrypt + Decrypt), remaining sockets are checked for reachability (Status only)") fs.DurationVar(&o.kmsCallTimeout, "kms-call-timeout", 0, "timeout for each gRPC call to the KMS plugin") - fs.StringVar(&o.configHash, "config-hash", o.configHash, "hash of config to use for encryption") fs.StringVar(&o.podName, "pod-name", o.podName, "name of pod to use to report checker status") fs.StringVar(&o.podNamespace, "pod-namespace", o.podNamespace, "namespace of pod to report checker status") fs.StringVar(&o.kubeconfig, "kubeconfig", o.kubeconfig, "path to a kubeconfig; empty uses in-cluster config") @@ -75,9 +73,6 @@ func (o *options) validate() error { if o.kmsCallTimeout <= 0 { return fmt.Errorf("--kms-call-timeout must be greater than 0") } - if o.configHash == "" { - return fmt.Errorf("--config-hash is required") - } if o.podName == "" { return fmt.Errorf("--pod-name is required") } @@ -126,7 +121,7 @@ func (o *options) run(ctx context.Context) error { status, checkErr := checker.check(ctx) podClient := kubeClient.CoreV1().Pods(o.podNamespace) - reportErr := setPodCheckCondition(ctx, podClient, o.podName, o.configHash, status, checkErr) + reportErr := setPodCheckCondition(ctx, podClient, o.podName, status, checkErr) // join the errors to not lose the original error message if err := errors.Join(checkErr, reportErr); err != nil { return err diff --git a/vendor/github.com/openshift/library-go/pkg/operator/encryption/kms/preflight/pod_status.go b/vendor/github.com/openshift/library-go/pkg/operator/encryption/kms/preflight/pod_status.go index 9e53ed01b1..d2e2c321c6 100644 --- a/vendor/github.com/openshift/library-go/pkg/operator/encryption/kms/preflight/pod_status.go +++ b/vendor/github.com/openshift/library-go/pkg/operator/encryption/kms/preflight/pod_status.go @@ -12,9 +12,9 @@ import ( kmsservice "k8s.io/kms/pkg/service" ) -func setPodCheckCondition(ctx context.Context, podClient corev1client.PodInterface, podName string, configHash string, +func setPodCheckCondition(ctx context.Context, podClient corev1client.PodInterface, podName string, status *kmsservice.StatusResponse, checkErr error) error { - conditions := podCheckConditions(configHash, status, checkErr) + conditions := podCheckConditions(status, checkErr) return updatePodCheckConditions(ctx, podClient, podName, conditions) } @@ -46,7 +46,7 @@ func updatePodCheckConditions(ctx context.Context, podClient corev1client.PodInt return nil } -func podCheckConditions(configHash string, status *kmsservice.StatusResponse, checkErr error) []corev1.PodCondition { +func podCheckConditions(status *kmsservice.StatusResponse, checkErr error) []corev1.PodCondition { now := metav1.Now() checkStatus, checkReason, checkMessage := corev1.ConditionTrue, "Succeeded", "" @@ -62,12 +62,6 @@ func podCheckConditions(configHash string, status *kmsservice.StatusResponse, ch Message: checkMessage, LastTransitionTime: now, }, - { - Type: controllers.KMSPreflightConfigHashPodCondition, - Status: corev1.ConditionTrue, - Message: configHash, - LastTransitionTime: now, - }, } if status != nil { diff --git a/vendor/github.com/openshift/library-go/pkg/operator/status/status_controller.go b/vendor/github.com/openshift/library-go/pkg/operator/status/status_controller.go index de348e797d..d53da28dac 100644 --- a/vendor/github.com/openshift/library-go/pkg/operator/status/status_controller.go +++ b/vendor/github.com/openshift/library-go/pkg/operator/status/status_controller.go @@ -52,6 +52,7 @@ type StatusSyncer struct { controllerFactory *factory.Factory recorder events.Recorder degradedInertia Inertia + availableInertia Inertia removeUnusedVersions bool } @@ -123,6 +124,14 @@ func (c *StatusSyncer) WithDegradedInertia(inertia Inertia) *StatusSyncer { return &output } +// WithAvailableInertia returns a copy of the StatusSyncer with the +// requested inertia function for available conditions. +func (c *StatusSyncer) WithAvailableInertia(inertia Inertia) *StatusSyncer { + output := *c + output.availableInertia = inertia + return &output +} + // WithVersionRemoval returns a copy of the StatusSyncer that will // remove versions that are missing in VersionGetter from the status. func (c *StatusSyncer) WithVersionRemoval() *StatusSyncer { @@ -217,7 +226,7 @@ func (c StatusSyncer) Sync(ctx context.Context, syncCtx factory.SyncContext) err configv1helpers.SetStatusCondition(&clusterOperatorObj.Status.Conditions, UnionClusterCondition(configv1.OperatorDegraded, operatorv1.ConditionFalse, c.degradedInertia, currentDetailedStatus.Conditions...), c.clock) configv1helpers.SetStatusCondition(&clusterOperatorObj.Status.Conditions, UnionClusterCondition(configv1.OperatorProgressing, operatorv1.ConditionFalse, nil, currentDetailedStatus.Conditions...), c.clock) - configv1helpers.SetStatusCondition(&clusterOperatorObj.Status.Conditions, UnionClusterCondition(configv1.OperatorAvailable, operatorv1.ConditionTrue, nil, currentDetailedStatus.Conditions...), c.clock) + configv1helpers.SetStatusCondition(&clusterOperatorObj.Status.Conditions, UnionClusterCondition(configv1.OperatorAvailable, operatorv1.ConditionTrue, c.availableInertia, currentDetailedStatus.Conditions...), c.clock) configv1helpers.SetStatusCondition(&clusterOperatorObj.Status.Conditions, UnionClusterCondition(configv1.OperatorUpgradeable, operatorv1.ConditionTrue, nil, currentDetailedStatus.Conditions...), c.clock) configv1helpers.SetStatusCondition(&clusterOperatorObj.Status.Conditions, UnionClusterCondition(configv1.EvaluationConditionsDetected, operatorv1.ConditionFalse, nil, currentDetailedStatus.Conditions...), c.clock) diff --git a/vendor/github.com/openshift/library-go/test/library/encryption/kms/vault.go b/vendor/github.com/openshift/library-go/test/library/encryption/kms/vault.go index 84c2b11875..906ff5e06c 100644 --- a/vendor/github.com/openshift/library-go/test/library/encryption/kms/vault.go +++ b/vendor/github.com/openshift/library-go/test/library/encryption/kms/vault.go @@ -213,7 +213,7 @@ func rotateKey(ctx context.Context, t testing.TB) { // Command: vault write -f transit/keys//rotate // Reference: https://developer.hashicorp.com/vault/api-docs/secret/transit#rotate-key cmd := exec.CommandContext(commandCtx, "oc", "exec", defaultVaultPodName, "-n", defaultVaultNamespace, "--", - "vault", "write", "-f", fmt.Sprintf("%s/rotate", defaultVaultKeyPath)) + "vault", "write", fmt.Sprintf("-namespace=%s", defaultVaultEnterpriseNS), "-f", fmt.Sprintf("%s/rotate", defaultVaultKeyPath)) t.Logf("Executing: %s", cmd.String()) output, err := cmd.Output() @@ -231,7 +231,7 @@ func getCurrentKeyVersion(ctx context.Context, t testing.TB) int { defer cancel() cmd := exec.CommandContext(commandCtx, "oc", "exec", defaultVaultPodName, "-n", defaultVaultNamespace, "--", - "vault", "read", "-field=latest_version", defaultVaultKeyPath) + "vault", "read", fmt.Sprintf("-namespace=%s", defaultVaultEnterpriseNS), "-field=latest_version", defaultVaultKeyPath) t.Logf("Executing: %s", cmd.String()) output, err := cmd.Output() diff --git a/vendor/modules.txt b/vendor/modules.txt index bfdeb4f3f1..2dbe50fac3 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -412,7 +412,7 @@ github.com/openshift/client-go/user/applyconfigurations/internal github.com/openshift/client-go/user/applyconfigurations/user/v1 github.com/openshift/client-go/user/clientset/versioned/scheme github.com/openshift/client-go/user/clientset/versioned/typed/user/v1 -# github.com/openshift/library-go v0.0.0-20260902083006-63bdbfb4da6b +# github.com/openshift/library-go v0.0.0-20260904093542-946ee696bcb5 ## explicit; go 1.26.0 github.com/openshift/library-go/pkg/apiserver/jsonpatch github.com/openshift/library-go/pkg/apps/deployment