Merge pull request #253 from openshift-cloud-team/OCPBUGS-6698

OCPBUGS-66948: Pin IPAM CRDs to release-4.20

Author: openshift-merge-bot[bot]

openshift/Makefile

@@ -1,10 +1,13 @@
-BIN_DIR := bin
 TOOLS_DIR := tools
 
 $(RELEASE_DIR):
 	mkdir -p $(RELEASE_DIR)/
 
-MANIFESTS_GEN := go run ./vendor/github.com/openshift/cluster-capi-operator/manifests-gen/
+MANIFESTS_GEN := $(TOOLS_DIR)/bin/manifests-gen
+KUSTOMIZE := $(TOOLS_DIR)/bin/kustomize
+
+$(TOOLS_DIR)/bin/%:
+	$(MAKE) -C $(TOOLS_DIR) bin/$*
 
 .PHONY: check-env
 check-env:
@@ -16,8 +19,21 @@ endif
 update-manifests-gen:
 	cd tools && go get github.com/openshift/cluster-capi-operator/manifests-gen && go mod tidy && go mod vendor
 
+.PHONY: update-ipam-ref
+update-ipam-ref:
+	# Get the current HEAD of the release-4.20 branch
+	$(eval current_head := $(shell git ls-remote https://github.com/openshift/cluster-api release-4.20 | awk '$$2 == "refs/heads/release-4.20" {print $$1}'))
+
+	# Pin the current head in the ipam CRD kustomize resource target
+	sed -i "s,https://github.com/openshift/cluster-api/config/crd?ref=.*,https://github.com/openshift/cluster-api/config/crd?ref=$(current_head)," ipam/kustomization.yaml
+
+.PHONY: ipam-manifests
+ipam-manifests: $(KUSTOMIZE)
+	$(KUSTOMIZE) build ipam -o manifests/0000_30_cluster-api_04_crd.core-cluster-api.yaml
+
+# Rebasebot runs ocp-manifests, so we make it generate ipam-manifests too
 .PHONY: ocp-manifests
-ocp-manifests: $(RELEASE_DIR) check-env ## Builds openshift specific manifests
+ocp-manifests: ipam-manifests $(MANIFESTS_GEN) check-env | $(RELEASE_DIR) ## Builds openshift specific manifests
 	# Generate provider manifests.
 	# TODO: load the provider-version dynamically at rebase time when this is invoked by the Rebase Bot during one of its lifecycle hooks.
-	cd tools && $(MANIFESTS_GEN) --provider-name "cluster-api" --provider-type "CoreProvider" --provider-version "${PROVIDER_VERSION}" --base-path "../../" --manifests-path "../manifests" --kustomize-dir="openshift"
+	$(MANIFESTS_GEN) --provider-name "cluster-api" --provider-type "CoreProvider" --provider-version "${PROVIDER_VERSION}" --base-path "../" --manifests-path "./manifests" --kustomize-dir="openshift"

openshift/infrastructure-components-openshift.yaml

@@ -8,7 +8,6 @@ metadata:
     include.release.openshift.io/single-node-developer: "true"
     release.openshift.io/feature-set: CustomNoUpgrade,TechPreviewNoUpgrade
     service.beta.openshift.io/inject-cabundle: "true"
-  creationTimestamp: null
   labels:
     cluster.x-k8s.io/provider: cluster-api
     clusterctl.cluster.x-k8s.io: ""
@@ -5318,7 +5317,6 @@ metadata:
     include.release.openshift.io/single-node-developer: "true"
     release.openshift.io/feature-set: CustomNoUpgrade,TechPreviewNoUpgrade
     service.beta.openshift.io/inject-cabundle: "true"
-  creationTimestamp: null
   labels:
     cluster.x-k8s.io/provider: cluster-api
     clusterctl.cluster.x-k8s.io: ""
@@ -9109,7 +9107,6 @@ metadata:
     include.release.openshift.io/single-node-developer: "true"
     release.openshift.io/feature-set: CustomNoUpgrade,TechPreviewNoUpgrade
     service.beta.openshift.io/inject-cabundle: "true"
-  creationTimestamp: null
   labels:
     cluster.x-k8s.io/provider: cluster-api
     clusterctl.cluster.x-k8s.io: ""
@@ -11272,7 +11269,6 @@ metadata:
     include.release.openshift.io/single-node-developer: "true"
     release.openshift.io/feature-set: CustomNoUpgrade,TechPreviewNoUpgrade
     service.beta.openshift.io/inject-cabundle: "true"
-  creationTimestamp: null
   labels:
     cluster.x-k8s.io/provider: cluster-api
     clusterctl.cluster.x-k8s.io: ""
@@ -13555,7 +13551,6 @@ metadata:
     include.release.openshift.io/single-node-developer: "true"
     release.openshift.io/feature-set: CustomNoUpgrade,TechPreviewNoUpgrade
     service.beta.openshift.io/inject-cabundle: "true"
-  creationTimestamp: null
   labels:
     cluster.x-k8s.io/provider: cluster-api
     clusterctl.cluster.x-k8s.io: ""
@@ -16170,7 +16165,6 @@ metadata:
     include.release.openshift.io/single-node-developer: "true"
     release.openshift.io/feature-set: CustomNoUpgrade,TechPreviewNoUpgrade
     service.beta.openshift.io/inject-cabundle: "true"
-  creationTimestamp: null
   labels:
     cluster.x-k8s.io/provider: cluster-api
     clusterctl.cluster.x-k8s.io: ""
@@ -16971,7 +16965,6 @@ metadata:
     include.release.openshift.io/single-node-developer: "true"
     release.openshift.io/feature-set: CustomNoUpgrade,TechPreviewNoUpgrade
     service.beta.openshift.io/inject-cabundle: "true"
-  creationTimestamp: null
   labels:
     cluster.x-k8s.io/provider: cluster-api
     clusterctl.cluster.x-k8s.io: ""
@@ -19259,7 +19252,6 @@ metadata:
     include.release.openshift.io/single-node-developer: "true"
     release.openshift.io/feature-set: CustomNoUpgrade,TechPreviewNoUpgrade
     service.beta.openshift.io/inject-cabundle: "true"
-  creationTimestamp: null
   labels:
     cluster.x-k8s.io/provider: cluster-api
     clusterctl.cluster.x-k8s.io: ""
@@ -20174,7 +20166,6 @@ metadata:
     include.release.openshift.io/single-node-developer: "true"
     release.openshift.io/feature-set: CustomNoUpgrade,TechPreviewNoUpgrade
     service.beta.openshift.io/inject-cabundle: "true"
-  creationTimestamp: null
   labels:
     cluster.x-k8s.io/provider: cluster-api
     clusterctl.cluster.x-k8s.io: ""
@@ -20620,7 +20611,6 @@ metadata:
     include.release.openshift.io/single-node-developer: "true"
     release.openshift.io/feature-set: CustomNoUpgrade,TechPreviewNoUpgrade
     service.beta.openshift.io/inject-cabundle: "true"
-  creationTimestamp: null
   labels:
     cluster.x-k8s.io/provider: cluster-api
     clusterctl.cluster.x-k8s.io: ""
@@ -22066,7 +22056,6 @@ metadata:
     include.release.openshift.io/single-node-developer: "true"
     release.openshift.io/feature-set: CustomNoUpgrade,TechPreviewNoUpgrade
     service.beta.openshift.io/inject-cabundle: "true"
-  creationTimestamp: null
   labels:
     cluster.x-k8s.io/provider: cluster-api
     clusterctl.cluster.x-k8s.io: ""
@@ -22819,8 +22808,8 @@ metadata:
     exclude.release.openshift.io/internal-openshift-hosted: "true"
     include.release.openshift.io/self-managed-high-availability: "true"
     include.release.openshift.io/single-node-developer: "true"
+    release.openshift.io/feature-set: CustomNoUpgrade,TechPreviewNoUpgrade
     service.beta.openshift.io/inject-cabundle: "true"
-  creationTimestamp: null
   labels:
     cluster.x-k8s.io/provider: cluster-api
     clusterctl.cluster.x-k8s.io: ""
@@ -23186,8 +23175,8 @@ metadata:
     exclude.release.openshift.io/internal-openshift-hosted: "true"
     include.release.openshift.io/self-managed-high-availability: "true"
     include.release.openshift.io/single-node-developer: "true"
+    release.openshift.io/feature-set: CustomNoUpgrade,TechPreviewNoUpgrade
     service.beta.openshift.io/inject-cabundle: "true"
-  creationTimestamp: null
   labels:
     cluster.x-k8s.io/provider: cluster-api
     clusterctl.cluster.x-k8s.io: ""
@@ -23816,7 +23805,6 @@ metadata:
     include.release.openshift.io/self-managed-high-availability: "true"
     include.release.openshift.io/single-node-developer: "true"
     release.openshift.io/feature-set: CustomNoUpgrade,TechPreviewNoUpgrade
-  creationTimestamp: null
   labels:
     cluster.x-k8s.io/provider: cluster-api
     clusterctl.cluster.x-k8s.io: ""
@@ -24073,7 +24061,6 @@ metadata:
     include.release.openshift.io/self-managed-high-availability: "true"
     include.release.openshift.io/single-node-developer: "true"
     release.openshift.io/feature-set: CustomNoUpgrade,TechPreviewNoUpgrade
-  creationTimestamp: null
   labels:
     cluster.x-k8s.io/provider: cluster-api
     clusterctl.cluster.x-k8s.io: ""
@@ -24109,7 +24096,6 @@ rules: []
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  creationTimestamp: null
   labels:
     cluster.x-k8s.io/provider: cluster-api
     clusterctl.cluster.x-k8s.io: ""
@@ -24127,7 +24113,6 @@ spec:
     metadata:
       annotations:
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
-      creationTimestamp: null
       labels:
         cluster.x-k8s.io/provider: cluster-api
         control-plane: controller-manager
@@ -24216,7 +24201,6 @@ kind: MutatingWebhookConfiguration
 metadata:
   annotations:
     service.beta.openshift.io/inject-cabundle: "true"
-  creationTimestamp: null
   labels:
     cluster.x-k8s.io/provider: cluster-api
     clusterctl.cluster.x-k8s.io: ""
@@ -24404,7 +24388,6 @@ kind: ValidatingWebhookConfiguration
 metadata:
   annotations:
     service.beta.openshift.io/inject-cabundle: "true"
-  creationTimestamp: null
   labels:
     cluster.x-k8s.io/provider: cluster-api
     clusterctl.cluster.x-k8s.io: ""

openshift/ipam/kustomization.yaml

@@ -0,0 +1,50 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# MAPV uses the CAPI IPAM CRDs. Until CAPI reaches GA, these CRDs must be
+# separately installed in production clusters. This workaround can be removed
+# when CAPI reaches GA: they will be installed via the CAPI Operator manifests
+# along with all other CAPI CRDs.
+#
+# In 4.21 we bumped CAPI to a version which includes v1beta2, and therefore
+# requires a conversion webhook. This would break production vsphere clusters
+# using IPAM, because we are not yet deploying this webhook in production
+# clusters. As MAPV does not require the v1beta2 IPAM CRDs, we pin them at the
+# versions shipped in 4.20 for now.
+
+commonAnnotations:
+  # Boilerplate annotations
+  exclude.release.openshift.io/internal-openshift-hosted: "true"
+  include.release.openshift.io/self-managed-high-availability: "true"
+  include.release.openshift.io/single-node-developer: "true"
+
+  # Instructs CVO to only install these resources in clusters with the Default
+  # featureset. Specifically this means that they will not be installed in
+  # (TechPreview|Custom|Dev)NoUpgrade clusters.
+  release.openshift.io/feature-set: Default
+
+resources:
+# Pinned at 4.20, as that was the last release which didn't have v1beta2
+- https://github.com/openshift/cluster-api/config/crd?ref=de1db2970e7fede7101e5a8188e74942ab6665e3
+
+# Together these 2 patches remove all CRDs except those with the name suffix
+# '.ipam.cluster.x-k8s.io'
+patches:
+
+# First add the local-config annotation to all CRDs.
+# kustomize will not emit resources with this annotation
+- target:
+    kind: CustomResourceDefinition
+  patch: |
+    - op: "add"
+      path: "/metadata/annotations/config.kubernetes.io~1local-config"
+      value: "true"
+
+# Then selectively remove the local-config annotation from CRDs in
+# ipam.cluster.x-k8s.io, meaning they will be emitted
+- target:
+    kind: CustomResourceDefinition
+    name: '.*\.ipam\.cluster\.x-k8s\.io$'
+  patch: |
+    - op: remove
+      path: "/metadata/annotations/config.kubernetes.io~1local-config"