OCPBUGS-66251: OADP restore results in htpasswd no longer being applied as volume#7628
OCPBUGS-66251: OADP restore results in htpasswd no longer being applied as volume#7628mehabhalodiya wants to merge 1 commit intoopenshift:mainfrom
Conversation
openshift-ci-robot
added
jira/severity-important
|
@mehabhalodiya: This pull request references Jira Issue OCPBUGS-66251, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Caution Review failedFailed to post review comments WalkthroughThis PR updates Go toolchain from 1.24 to 1.25 across build files, enhances GCP platform support with Workload Identity Federation and resource labeling, introduces node CIDR allocation controls and AWS network load balancer EIP/subnet configurations, adds OKD feature gate support, expands API validations and TLS profile guidance, updates Tekton task digests, adds documentation for new Claude commands, and adjusts project ownership rules. Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
Comment |
openshift-ci
bot
added
area/control-plane-operator
mehabhalodiya
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In
`@control-plane-operator/controllers/hostedcontrolplane/v2/oauth/deployment.go`:
- Around line 95-118: When identityProviders > 0, removeIDPVolumeMounts must run
regardless of whether ConvertIdentityProviders returned volumes to avoid leaving
stale mounts; change the block handling ConvertIdentityProviders so that after
calling removeIDPVolumes(deployment) and calling ConvertIdentityProviders(...)
you always call removeIDPVolumeMounts(deployment) before inspecting
volumeMountInfo.Volumes, then only append volumeMountInfo.Volumes and update
container mounts via util.UpdateContainer(ComponentName, ...) if
len(volumeMountInfo.Volumes) > 0. Ensure the same functions (removeIDPVolumes,
removeIDPVolumeMounts, ConvertIdentityProviders, util.UpdateContainer,
ComponentName, deployment) are used and no other behavior changes.
| identityProviders := configuration.OAuth.IdentityProviders | ||
| if len(identityProviders) > 0 { | ||
| // Remove any existing IDP volumes to ensure clean state after restore | ||
| // This is important for OADP restore scenarios where the deployment | ||
| // might be restored with stale volume configurations | ||
| removeIDPVolumes(deployment) | ||
|
|
||
| _, volumeMountInfo, _ := ConvertIdentityProviders(cpContext, identityProviders, providerOverrides(cpContext.HCP), cpContext.Client, deployment.Namespace) | ||
| // Ignore the error here, since we don't want to fail the deployment if the identity providers are invalid | ||
| // A condition will be set on the HC to indicate the error | ||
| if len(volumeMountInfo.Volumes) > 0 { | ||
| // Remove any existing IDP volume mounts before adding new ones | ||
| removeIDPVolumeMounts(deployment) | ||
|
|
||
| deployment.Spec.Template.Spec.Volumes = append(deployment.Spec.Template.Spec.Volumes, volumeMountInfo.Volumes...) | ||
| util.UpdateContainer(ComponentName, deployment.Spec.Template.Spec.Containers, func(c *corev1.Container) { | ||
| c.VolumeMounts = append(c.VolumeMounts, volumeMountInfo.VolumeMounts.ContainerMounts(ComponentName)...) | ||
| }) | ||
| } | ||
| } else { | ||
| // If no identity providers are configured, ensure any stale IDP volumes are removed | ||
| removeIDPVolumes(deployment) | ||
| removeIDPVolumeMounts(deployment) | ||
| } |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Find the ConvertIdentityProviders function
fd -t f -e go -path "*oauth*" control-plane-operator/controllers/hostedcontrolplane/v2 | head -20Repository: openshift/hypershift
Length of output: 232
🏁 Script executed:
#!/bin/bash
# Search for ConvertIdentityProviders implementation
rg "func ConvertIdentityProviders" -A 50 --type goRepository: openshift/hypershift
Length of output: 11465
🏁 Script executed:
#!/bin/bash
# Also search for the removeIDPVolumes and removeIDPVolumeMounts functions
rg "func (.*)?removeIDPVolumes|func (.*)?removeIDPVolumeMounts" -A 15 --type goRepository: openshift/hypershift
Length of output: 3071
Fix dangling IDP mounts when volume conversion fails.
When ConvertIdentityProviders produces zero volumes (e.g., all providers fail conversion), removeIDPVolumes runs unconditionally, but removeIDPVolumeMounts is skipped because volumeMountInfo.Volumes is empty. This leaves stale mounts referencing volumes that no longer exist, creating an inconsistent pod spec. Move removeIDPVolumeMounts outside the conditional to always clean up mounts alongside volumes.
✅ Suggested adjustment
- removeIDPVolumes(deployment)
-
- _, volumeMountInfo, _ := ConvertIdentityProviders(cpContext, identityProviders, providerOverrides(cpContext.HCP), cpContext.Client, deployment.Namespace)
+ removeIDPVolumes(deployment)
+ removeIDPVolumeMounts(deployment)
+
+ _, volumeMountInfo, _ := ConvertIdentityProviders(cpContext, identityProviders, providerOverrides(cpContext.HCP), cpContext.Client, deployment.Namespace)
// Ignore the error here, since we don't want to fail the deployment if the identity providers are invalid
// A condition will be set on the HC to indicate the error
if len(volumeMountInfo.Volumes) > 0 {
- // Remove any existing IDP volume mounts before adding new ones
- removeIDPVolumeMounts(deployment)
-
deployment.Spec.Template.Spec.Volumes = append(deployment.Spec.Template.Spec.Volumes, volumeMountInfo.Volumes...)
util.UpdateContainer(ComponentName, deployment.Spec.Template.Spec.Containers, func(c *corev1.Container) {
c.VolumeMounts = append(c.VolumeMounts, volumeMountInfo.VolumeMounts.ContainerMounts(ComponentName)...)
})
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| identityProviders := configuration.OAuth.IdentityProviders | |
| if len(identityProviders) > 0 { | |
| // Remove any existing IDP volumes to ensure clean state after restore | |
| // This is important for OADP restore scenarios where the deployment | |
| // might be restored with stale volume configurations | |
| removeIDPVolumes(deployment) | |
| _, volumeMountInfo, _ := ConvertIdentityProviders(cpContext, identityProviders, providerOverrides(cpContext.HCP), cpContext.Client, deployment.Namespace) | |
| // Ignore the error here, since we don't want to fail the deployment if the identity providers are invalid | |
| // A condition will be set on the HC to indicate the error | |
| if len(volumeMountInfo.Volumes) > 0 { | |
| // Remove any existing IDP volume mounts before adding new ones | |
| removeIDPVolumeMounts(deployment) | |
| deployment.Spec.Template.Spec.Volumes = append(deployment.Spec.Template.Spec.Volumes, volumeMountInfo.Volumes...) | |
| util.UpdateContainer(ComponentName, deployment.Spec.Template.Spec.Containers, func(c *corev1.Container) { | |
| c.VolumeMounts = append(c.VolumeMounts, volumeMountInfo.VolumeMounts.ContainerMounts(ComponentName)...) | |
| }) | |
| } | |
| } else { | |
| // If no identity providers are configured, ensure any stale IDP volumes are removed | |
| removeIDPVolumes(deployment) | |
| removeIDPVolumeMounts(deployment) | |
| } | |
| identityProviders := configuration.OAuth.IdentityProviders | |
| if len(identityProviders) > 0 { | |
| // Remove any existing IDP volumes to ensure clean state after restore | |
| // This is important for OADP restore scenarios where the deployment | |
| // might be restored with stale volume configurations | |
| removeIDPVolumes(deployment) | |
| removeIDPVolumeMounts(deployment) | |
| _, volumeMountInfo, _ := ConvertIdentityProviders(cpContext, identityProviders, providerOverrides(cpContext.HCP), cpContext.Client, deployment.Namespace) | |
| // Ignore the error here, since we don't want to fail the deployment if the identity providers are invalid | |
| // A condition will be set on the HC to indicate the error | |
| if len(volumeMountInfo.Volumes) > 0 { | |
| deployment.Spec.Template.Spec.Volumes = append(deployment.Spec.Template.Spec.Volumes, volumeMountInfo.Volumes...) | |
| util.UpdateContainer(ComponentName, deployment.Spec.Template.Spec.Containers, func(c *corev1.Container) { | |
| c.VolumeMounts = append(c.VolumeMounts, volumeMountInfo.VolumeMounts.ContainerMounts(ComponentName)...) | |
| }) | |
| } | |
| } else { | |
| // If no identity providers are configured, ensure any stale IDP volumes are removed | |
| removeIDPVolumes(deployment) | |
| removeIDPVolumeMounts(deployment) | |
| } |
🤖 Prompt for AI Agents
In `@control-plane-operator/controllers/hostedcontrolplane/v2/oauth/deployment.go`
around lines 95 - 118, When identityProviders > 0, removeIDPVolumeMounts must
run regardless of whether ConvertIdentityProviders returned volumes to avoid
leaving stale mounts; change the block handling ConvertIdentityProviders so that
after calling removeIDPVolumes(deployment) and calling
ConvertIdentityProviders(...) you always call removeIDPVolumeMounts(deployment)
before inspecting volumeMountInfo.Volumes, then only append
volumeMountInfo.Volumes and update container mounts via
util.UpdateContainer(ComponentName, ...) if len(volumeMountInfo.Volumes) > 0.
Ensure the same functions (removeIDPVolumes, removeIDPVolumeMounts,
ConvertIdentityProviders, util.UpdateContainer, ComponentName, deployment) are
used and no other behavior changes.
|
/assign @jparrill |
mehabhalodiya
force-pushed
the
oadp-oauth
branch
from
cf02839 to
3f75e61
Compare
openshift-merge-robot
added
the
needs-rebase
openshift-ci
bot
added
area/ai
openshift-ci-robot
added
the
jira/valid-bug
openshift-ci-robot
removed
the
jira/invalid-bug
|
@mehabhalodiya: This pull request references Jira Issue OCPBUGS-66251, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (yli2@redhat.com), skipping review request. The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
jira/invalid-bug
|
@mehabhalodiya: This pull request references Jira Issue OCPBUGS-66251, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
mehabhalodiya
force-pushed
the
oadp-oauth
branch
from
3f75e61 to
cf02839
Compare
openshift-ci-robot
added
jira/valid-bug
|
@mehabhalodiya: This pull request references Jira Issue OCPBUGS-66251, which is valid. 3 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (yli2@redhat.com), skipping review request. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-merge-robot
removed
the
needs-rebase
mehabhalodiya
force-pushed
the
oadp-oauth
branch
from
cf02839 to
7723b8d
Compare
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: mehabhalodiya The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
This PR fixes an issue where OAuth identity provider (IDP) secrets are not mounted as volumes in the oauth-openshift deployment after OADP restore operations. Signed-off-by: mehabhalodiya <mehabhalodiya@gmail.com>
mehabhalodiya
force-pushed
the
oadp-oauth
branch
from
7723b8d to
08f2779
Compare
|
@mehabhalodiya: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
4 participants
This PR fixes an issue where OAuth identity provider (IDP) secrets are not mounted as volumes in the oauth-openshift deployment after OADP restore operations.
What this PR does / why we need it:
Problem
After restoring a HostedCluster using the OADP plugin, htpasswd IDP secrets exist in the HCP namespace but are not mounted as volumes in the oauth-openshift deployment. This prevents OAuth authentication from working with the IDP.
Root Cause
The oauth-openshift deployment reconciliation logic appends IDP volumes to the existing volumes list without first removing stale volumes. When OADP restores the deployment, it may restore with:
The reconciliation doesn't clean up these stale volumes, leading to inconsistent state.
Solution
HyperShift Codebase Fix
File:
control-plane-operator/controllers/hostedcontrolplane/v2/oauth/deployment.goChanges:
removeIDPVolumes()function to clean up stale IDP volumesremoveIDPVolumeMounts()function to clean up stale IDP volume mountsadaptDeployment()to remove stale volumes/mounts before adding new onesKey Benefits:
Which issue(s) this PR fixes:
Fixes https://issues.redhat.com/browse/OCPBUGS-66251
Special notes for your reviewer:
Checklist:
Summary by CodeRabbit
Release Notes
New Features
Infrastructure Updates
Documentation