Skip to content

OCPBUGS-65476: Add openshift-ingress-operator ClusterRole to ClusterO…#1313

Open
davidesalerno wants to merge 1 commit intoopenshift:masterfrom
davidesalerno:ocpbugs65476
Open

OCPBUGS-65476: Add openshift-ingress-operator ClusterRole to ClusterO…#1313
davidesalerno wants to merge 1 commit intoopenshift:masterfrom
davidesalerno:ocpbugs65476

Conversation

@davidesalerno
Copy link
Copy Markdown
Contributor

…perator relatedObjects

This change adds the openshift-ingress-operator ClusterRole to the ClusterOperator relatedObjects

@openshift-ci-robot openshift-ci-robot added jira/severity-low Referenced Jira bug's severity is low for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Nov 28, 2025
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

@davidesalerno: This pull request references Jira Issue OCPBUGS-65476, which is invalid:

  • expected the bug to target the "4.21.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

…perator relatedObjects

This change adds the openshift-ingress-operator ClusterRole to the ClusterOperator relatedObjects

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@davidesalerno davidesalerno changed the title OCPBUGS-65476: Add openshift-ingress-operator ClusterRole to ClusterO… [WIP] OCPBUGS-65476: Add openshift-ingress-operator ClusterRole to ClusterO… Nov 28, 2025
@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 28, 2025
@openshift-ci openshift-ci Bot requested review from frobware and knobunc November 28, 2025 15:39
@davidesalerno
Copy link
Copy Markdown
Contributor Author

/retest-required

@davidesalerno davidesalerno changed the title [WIP] OCPBUGS-65476: Add openshift-ingress-operator ClusterRole to ClusterO… OCPBUGS-65476: Add openshift-ingress-operator ClusterRole to ClusterO… Dec 2, 2025
@openshift-ci openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 2, 2025
@grzpiotrowski
Copy link
Copy Markdown
Contributor

/assign

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented Dec 4, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from grzpiotrowski. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Comment on lines +36 to +38
- group: rbac.authorization.k8s.io
name: ingress-operator
resource: clusterrolebindings
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The name here should match the name in manifests/01-cluster-role-binding.yaml:

Suggested change
- group: rbac.authorization.k8s.io
name: ingress-operator
resource: clusterrolebindings
- group: rbac.authorization.k8s.io
name: openshift-ingress-operator
resource: clusterrolebindings

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: openshift-ingress-operator

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe you were looking at the rolebinding's name? We should probably include these too:

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: ingress-operator
namespace: openshift-ingress-operator

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: ingress-operator
namespace: openshift-config

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

...and then we might as well include the roles as well:

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: ingress-operator
namespace: openshift-ingress-operator

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: ingress-operator
namespace: openshift-config

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Miciah I updated the code accordingly and in particular:

  • fixed ClusterRole name
  • added the Roles and RolesBinding

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As we discussed, it would also make sense to get the cluster ingress config and copy entries from Ingress.status.componentRoutes.relatedObjects to ClusterOperator.status.relatedObjects in Reconcile.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I updated the controller with the requested change.

@davidesalerno davidesalerno changed the title OCPBUGS-65476: Add openshift-ingress-operator ClusterRole to ClusterO… [WIP] OCPBUGS-65476: Add openshift-ingress-operator ClusterRole to ClusterO… Dec 4, 2025
@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 4, 2025
@davidesalerno davidesalerno force-pushed the ocpbugs65476 branch 3 times, most recently from d00d433 to 1c93ae3 Compare December 5, 2025 14:04
@davidesalerno davidesalerno marked this pull request as draft December 5, 2025 15:10
@davidesalerno
Copy link
Copy Markdown
Contributor Author

/test all

@davidesalerno davidesalerno changed the title [WIP] OCPBUGS-65476: Add openshift-ingress-operator ClusterRole to ClusterO… OCPBUGS-65476: Add openshift-ingress-operator ClusterRole to ClusterO… Dec 10, 2025
@davidesalerno davidesalerno marked this pull request as ready for review December 10, 2025 17:32
@davidesalerno
Copy link
Copy Markdown
Contributor Author

/retest-required

Copy link
Copy Markdown
Contributor

@grzpiotrowski grzpiotrowski left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@Miciah would you like to have another look since the last comments?

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jan 20, 2026
@davidesalerno
Copy link
Copy Markdown
Contributor Author

/retest-required

1 similar comment
@rikatz
Copy link
Copy Markdown
Member

rikatz commented Feb 25, 2026

/retest-required

@lihongan
Copy link
Copy Markdown

/jira refresh

@openshift-ci-robot
Copy link
Copy Markdown
Contributor

@lihongan: This pull request references Jira Issue OCPBUGS-65476, which is invalid:

  • expected the bug to target the "4.22.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@lihongan
Copy link
Copy Markdown

/jira refresh

@openshift-ci-robot openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Feb 26, 2026
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

@lihongan: This pull request references Jira Issue OCPBUGS-65476, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.22.0) matches configured target version for branch (4.22.0)
  • bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @melvinjoseph86

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@lihongan
Copy link
Copy Markdown

/retest-required

@lihongan
Copy link
Copy Markdown

One e2e test is failing

FAIL: TestAll/serial/TestClusterOperatorStatusRelatedObjects

@melvinjoseph86
Copy link
Copy Markdown

➜  oc get clusterversion
NAME      VERSION                                                AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.22.0-0-2026-03-02-061505-test-ci-ln-rmxzypb-latest   True        False         104m    Cluster version is 4.22.0-0-2026-03-02-061505-test-ci-ln-rmxzypb-latest

➜  oc adm inspect clusteroperator/ingress
Gathering data for ns/openshift-ingress-operator...
Warning: apps.openshift.io/v1 DeploymentConfig is deprecated in v4.14+, unavailable in v4.10000+
Warning: v1 Endpoints is deprecated in v1.33+; use discovery.k8s.io/v1 EndpointSlice
Gathering data for ns/openshift-ingress...
Gathering data for ns/openshift-ingress-canary...
Wrote inspect data to inspect.local.852661774645648715.
➜  ls inspect.local.*/cluster-scoped-resources/
config.openshift.io       operator.openshift.io     rbac.authorization.k8s.io

➜  oc get clusteroperator ingress -o json| jq -c '.status.relatedObjects[]' | grep clusterroles
{"group":"rbac.authorization.k8s.io","name":"openshift-ingress-operator","resource":"clusterroles"}

➜  oc get clusteroperator ingress -o json| jq -c '.status.relatedObjects[]' | grep clusterrolebindings
{"group":"rbac.authorization.k8s.io","name":"openshift-ingress-operator","resource":"clusterrolebindings"}
➜  oc get clusteroperator ingress -o json| jq -c '.status.relatedObjects[]' | grep roles              
{"group":"rbac.authorization.k8s.io","name":"openshift-ingress-operator","resource":"clusterroles"}
{"group":"rbac.authorization.k8s.io","name":"ingress-operator","namespace":"openshift-ingress-operator","resource":"roles"}
{"group":"rbac.authorization.k8s.io","name":"ingress-operator","namespace":"openshift-config","resource":"roles"}
➜  oc get clusteroperator ingress -o json| jq -c '.status.relatedObjects[]' | grep rolebindings
{"group":"rbac.authorization.k8s.io","name":"openshift-ingress-operator","resource":"clusterrolebindings"}
{"group":"rbac.authorization.k8s.io","name":"ingress-operator","namespace":"openshift-ingress-operator","resource":"rolebindings"}
{"group":"rbac.authorization.k8s.io","name":"ingress-operator","namespace":"openshift-config","resource":"rolebindings"}

Hence marking as verified
/verified by @melvinjoseph86

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Mar 2, 2026
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

@melvinjoseph86: This PR has been marked as verified by @melvinjoseph86.

Details

In response to this:

➜  oc get clusterversion
NAME      VERSION                                                AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.22.0-0-2026-03-02-061505-test-ci-ln-rmxzypb-latest   True        False         104m    Cluster version is 4.22.0-0-2026-03-02-061505-test-ci-ln-rmxzypb-latest

➜  oc adm inspect clusteroperator/ingress
Gathering data for ns/openshift-ingress-operator...
Warning: apps.openshift.io/v1 DeploymentConfig is deprecated in v4.14+, unavailable in v4.10000+
Warning: v1 Endpoints is deprecated in v1.33+; use discovery.k8s.io/v1 EndpointSlice
Gathering data for ns/openshift-ingress...
Gathering data for ns/openshift-ingress-canary...
Wrote inspect data to inspect.local.852661774645648715.
➜  ls inspect.local.*/cluster-scoped-resources/
config.openshift.io       operator.openshift.io     rbac.authorization.k8s.io

➜  oc get clusteroperator ingress -o json| jq -c '.status.relatedObjects[]' | grep clusterroles
{"group":"rbac.authorization.k8s.io","name":"openshift-ingress-operator","resource":"clusterroles"}

➜  oc get clusteroperator ingress -o json| jq -c '.status.relatedObjects[]' | grep clusterrolebindings
{"group":"rbac.authorization.k8s.io","name":"openshift-ingress-operator","resource":"clusterrolebindings"}
➜  oc get clusteroperator ingress -o json| jq -c '.status.relatedObjects[]' | grep roles              
{"group":"rbac.authorization.k8s.io","name":"openshift-ingress-operator","resource":"clusterroles"}
{"group":"rbac.authorization.k8s.io","name":"ingress-operator","namespace":"openshift-ingress-operator","resource":"roles"}
{"group":"rbac.authorization.k8s.io","name":"ingress-operator","namespace":"openshift-config","resource":"roles"}
➜  oc get clusteroperator ingress -o json| jq -c '.status.relatedObjects[]' | grep rolebindings
{"group":"rbac.authorization.k8s.io","name":"openshift-ingress-operator","resource":"clusterrolebindings"}
{"group":"rbac.authorization.k8s.io","name":"ingress-operator","namespace":"openshift-ingress-operator","resource":"rolebindings"}
{"group":"rbac.authorization.k8s.io","name":"ingress-operator","namespace":"openshift-config","resource":"rolebindings"}

Hence marking as verified
/verified by @melvinjoseph86

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@melvinjoseph86
Copy link
Copy Markdown

/retest

@melvinjoseph86
Copy link
Copy Markdown

/retest-required

@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 12, 2026
@openshift-merge-robot
Copy link
Copy Markdown
Contributor

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

…perator relatedObjects

Signed-off-by: Davide Salerno <dsalerno@redhat.com>
@openshift-ci-robot openshift-ci-robot removed the verified Signifies that the PR passed pre-merge verification criteria label Mar 24, 2026
@openshift-ci openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Mar 24, 2026
@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented Mar 24, 2026

New changes are detected. LGTM label has been removed.

@openshift-ci openshift-ci Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 24, 2026
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Mar 24, 2026

📝 Walkthrough

Walkthrough

This change extends the ingress cluster operator's status reporting to include RBAC-related objects in the status.relatedObjects list. The controller logic is updated to fetch the default ingress configuration and populate ingress component routes status. A deduplication helper is introduced to prevent duplicate object references. The manifest declaration and end-to-end tests are updated to verify that cluster-scoped and namespaced RBAC resources (clusterroles, clusterrolebindings, roles, and rolebindings) are properly tracked in the operator's status.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@pkg/operator/controller/status/controller.go`:
- Around line 490-497: Reconcile reads configv1.Ingress.status.componentRoutes
but New() doesn't watch Ingress, causing stale relatedObjects; update the
controller setup in New() to add a watch for configv1.Ingress so ingress status
changes trigger reconciles. Concretely, import configv1 and call
builder.Watches(&source.Kind{Type: &configv1.Ingress{}},
handler.EnqueueRequestsFromMapFunc(<map func that maps the Ingress event to the
primary resource this controller manages>)) or an appropriate handler (e.g.,
EnqueueRequestsForOwner/EnqueueRequestsForObject) so updates to
Ingress.status.ComponentRoutes cause the controller (the one constructed in
New()) to reconcile and refresh state.IngressComponentRoutesStatus.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 7a057001-6a81-473b-8cdd-3ee1ba7ddd44

📥 Commits

Reviewing files that changed from the base of the PR and between dd97cd3 and 2ba8ac3.

📒 Files selected for processing (3)
  • manifests/03-cluster-operator.yaml
  • pkg/operator/controller/status/controller.go
  • test/e2e/operator_test.go

Comment on lines +490 to +497
ingressConfig := &configv1.Ingress{}
if err := r.client.Get(ctx, operatorcontroller.IngressClusterConfigName(), ingressConfig); err != nil {
if !errors.IsNotFound(err) {
return state, fmt.Errorf("failed to get default ingress: %v", err)
}
} else {
state.IngressComponentRoutesStatus = ingressConfig.Status.ComponentRoutes
}
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Add a watch for configv1.Ingress to avoid stale relatedObjects

Line [490] makes reconcile depend on Ingress.status.componentRoutes, but New() does not watch configv1.Ingress. Updates to component routes may not propagate until an unrelated event triggers reconcile.

Proposed fix
@@
 	if err := c.Watch(source.Kind[client.Object](operatorCache, &configv1.ClusterOperator{}, handler.EnqueueRequestsFromMapFunc(toDefaultIngressController), predicate.NewPredicateFuncs(isIngressClusterOperator))); err != nil {
 		return nil, err
 	}
+
+	isClusterIngressConfig := predicate.NewPredicateFuncs(func(o client.Object) bool {
+		return o.GetName() == operatorcontroller.IngressClusterConfigName().Name
+	})
+	if err := c.Watch(source.Kind[client.Object](
+		operatorCache,
+		&configv1.Ingress{},
+		handler.EnqueueRequestsFromMapFunc(toDefaultIngressController),
+		isClusterIngressConfig,
+	)); err != nil {
+		return nil, err
+	}

As per coding guidelines, "Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity."

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
ingressConfig := &configv1.Ingress{}
if err := r.client.Get(ctx, operatorcontroller.IngressClusterConfigName(), ingressConfig); err != nil {
if !errors.IsNotFound(err) {
return state, fmt.Errorf("failed to get default ingress: %v", err)
}
} else {
state.IngressComponentRoutesStatus = ingressConfig.Status.ComponentRoutes
}
if err := c.Watch(source.Kind[client.Object](operatorCache, &configv1.ClusterOperator{}, handler.EnqueueRequestsFromMapFunc(toDefaultIngressController), predicate.NewPredicateFuncs(isIngressClusterOperator))); err != nil {
return nil, err
}
isClusterIngressConfig := predicate.NewPredicateFuncs(func(o client.Object) bool {
return o.GetName() == operatorcontroller.IngressClusterConfigName().Name
})
if err := c.Watch(source.Kind[client.Object](
operatorCache,
&configv1.Ingress{},
handler.EnqueueRequestsFromMapFunc(toDefaultIngressController),
isClusterIngressConfig,
)); err != nil {
return nil, err
}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@pkg/operator/controller/status/controller.go` around lines 490 - 497,
Reconcile reads configv1.Ingress.status.componentRoutes but New() doesn't watch
Ingress, causing stale relatedObjects; update the controller setup in New() to
add a watch for configv1.Ingress so ingress status changes trigger reconciles.
Concretely, import configv1 and call builder.Watches(&source.Kind{Type:
&configv1.Ingress{}}, handler.EnqueueRequestsFromMapFunc(<map func that maps the
Ingress event to the primary resource this controller manages>)) or an
appropriate handler (e.g., EnqueueRequestsForOwner/EnqueueRequestsForObject) so
updates to Ingress.status.ComponentRoutes cause the controller (the one
constructed in New()) to reconcile and refresh
state.IngressComponentRoutesStatus.

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented Mar 24, 2026

@davidesalerno: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-pre-release-ossm 4303bbd link false /test e2e-aws-pre-release-ossm
ci/prow/e2e-aws-operator 2ba8ac3 link true /test e2e-aws-operator
ci/prow/e2e-aws-ovn-hypershift-conformance 2ba8ac3 link true /test e2e-aws-ovn-hypershift-conformance
ci/prow/e2e-azure-operator 2ba8ac3 link true /test e2e-azure-operator
ci/prow/e2e-gcp-operator 2ba8ac3 link true /test e2e-gcp-operator

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

jira/severity-low Referenced Jira bug's severity is low for the branch this PR is targeting. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

8 participants