Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat : Valid (SingleNamespaced) Operator Installation in tenant namespace #2589

Open
wants to merge 6 commits into
base: main
Choose a base branch
from
Open

feat : Valid (SingleNamespaced) Operator Installation in tenant namespace #2589

wants to merge 6 commits into from
+392 −125

Conversation

bnshr
Copy link
Contributor

@bnshr bnshr commented Nov 25, 2024

Refers the issue

@bnshr bnshr marked this pull request as draft November 25, 2024 14:08
@bnshr bnshr force-pushed the CNFCERT-1088 branch 3 times, most recently from 98cb58b to 56d4773 Compare November 25, 2024 14:39
@dcibot
Copy link
Collaborator

dcibot commented Nov 25, 2024

from change #2589:

@bnshr bnshr force-pushed the CNFCERT-1088 branch 2 times, most recently from 1f928d0 to e3fd824 Compare November 25, 2024 15:09
@dcibot
Copy link
Collaborator

dcibot commented Nov 25, 2024

from change #2589:

@bnshr bnshr force-pushed the CNFCERT-1088 branch 2 times, most recently from 33278d6 to 26570f7 Compare November 25, 2024 16:20
@dcibot
Copy link
Collaborator

dcibot commented Nov 25, 2024

from change #2589:

@bnshr bnshr marked this pull request as ready for review November 25, 2024 19:17
sebrandon1
sebrandon1 reviewed Nov 25, 2024
View reviewed changes
Copy link
Member

@sebrandon1 sebrandon1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Initial set of comments

tests/operator/suite.go Outdated Show resolved Hide resolved
tests/operator/helper.go Outdated Show resolved Hide resolved
tests/operator/helper.go Outdated Show resolved Hide resolved
tests/operator/helper.go Show resolved Hide resolved
@bnshr bnshr force-pushed the CNFCERT-1088 branch 5 times, most recently from fad4dfa to 822dfe9 Compare November 26, 2024 16:15
@bnshr bnshr force-pushed the CNFCERT-1088 branch 2 times, most recently from 2ba0ff8 to 475f7b6 Compare November 27, 2024 20:29
@bnshr bnshr mentioned this pull request Nov 28, 2024
Merged
greyerof
greyerof reviewed Nov 29, 2024
View reviewed changes
tests/operator/suite.go Outdated Show resolved Hide resolved
@dcibot
Copy link
Collaborator

dcibot commented Jan 22, 2025

from change #2589:

sebrandon1
sebrandon1 reviewed Jan 22, 2025
View reviewed changes
tests/operator/suite.go Outdated
Comment on lines 146 to 152
operatorNamespaces := make(map[string]bool)
for _, operator := range env.Operators {
operatorNamespaces[operator.Namespace] = true
}

for operatorNamespace := range operatorNamespaces {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just thinking aloud.

Suggested change
operatorNamespaces := make(map[string]bool)
for _, operator := range env.Operators {
operatorNamespaces[operator.Namespace] = true
}
for operatorNamespace := range operatorNamespaces {
singleNamespaceOperators := make(map[string]bool)
for _, operator := range env.Operators {
// Add short circuit/not add cluster wide namespace to the list.
singleNamespaceOperators[operator.Namespace] = true
}
for operatorNamespace := range singleNamespaceOperators {

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I mark this as resolved by adding a new helper function to generate all non-compliant object message which would help to understand what conditions fail this test. Unit test is added for the same as well.

@bnshr bnshr force-pushed the CNFCERT-1088 branch 2 times, most recently from 100a06b to 4a90823 Compare January 22, 2025 17:12
edcdavid
edcdavid reviewed Jan 22, 2025
View reviewed changes
tests/operator/suite.go Outdated Show resolved Hide resolved
@bnshr bnshr force-pushed the CNFCERT-1088 branch 3 times, most recently from f1e2476 to 0e6d3e1 Compare January 22, 2025 17:52
edcdavid
edcdavid reviewed Jan 22, 2025
View reviewed changes
tests/operator/helper.go Outdated Show resolved Hide resolved
edcdavid
edcdavid reviewed Jan 22, 2025
View reviewed changes
CATALOG.md Outdated Show resolved Hide resolved
edcdavid
edcdavid reviewed Jan 22, 2025
View reviewed changes
tests/operator/helper.go Outdated Show resolved Hide resolved
edcdavid
edcdavid reviewed Jan 22, 2025
View reviewed changes
tests/operator/helper.go Outdated
if len(podsBelongingToNoOperators) == 0 && allOperatorsFoundInNamespaceAreValid {
return true, singleNamespacedCsvs, allNamespacedCsvs, podsBelongingToNoOperators, nil
} else {
return false, singleNamespacedCsvs, allNamespacedCsvs, podsBelongingToNoOperators, err
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

return nil here

edcdavid
edcdavid reviewed Jan 22, 2025
View reviewed changes
tests/operator/suite.go Outdated Show resolved Hide resolved
edcdavid
edcdavid reviewed Jan 22, 2025
View reviewed changes
tests/operator/helper.go
validOwnerFound := false
for _, owner := range topOwners {
if owner.Kind == v1alpha1.ClusterServiceVersionKind && owner.Namespace == namespace {
foundCsvs[owner.Name] = true
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We may need more checks here. other valid top owner could be the operands created based on the crds installed by this operator. Actually these operands can only be installed in the single operator namespace. For instance, for prometheus, pods belonging to the prometheus object top owner should be valid. We could list all the crds installs by this operator by reading the crd label: "operatorframework.io/installed-alongside-..." or similar then use the crd name to identify valid top owners.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@edcdavid that's only valid for operators installed with the ownNamespace mode. For singleNamespace operators, the controller is running in namespace A and watches for CRs in namespace B, so, in theory, operand pods should only be found in namespace B.

The problem is the requirement only referes to SingleNamespaced and AllNamespaced operators... so what about ownNamespaced and multiNamespaced ones?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ah, you are right about single namespace vs own namespace, in single namespace only mode, the operand should be in only in namespace B, sorry for the confusion. So in this case, we still need a way to ignore the csv that will be created in namespace B otherwise it will be picked up as an operator namespace.

Copy link
Member

@edcdavid edcdavid Jan 23, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The problem is the requirement only referes to SingleNamespaced and AllNamespaced operators... so what about ownNamespaced and multiNamespaced ones?

In my opinion, the multi namespace is similar to the single namespace and it would make sense to support it here.

@dcibot
Copy link
Collaborator

dcibot commented Jan 22, 2025

from change #2589:

@bnshr bnshr force-pushed the CNFCERT-1088 branch 2 times, most recently from a019beb to 23f4b89 Compare January 23, 2025 07:39
@dcibot
Copy link
Collaborator

dcibot commented Jan 23, 2025

from change #2589:

@dcibot
Copy link
Collaborator

dcibot commented Jan 23, 2025

from change #2589:

edcdavid
edcdavid reviewed Jan 23, 2025
View reviewed changes
tests/operator/helper.go Outdated Show resolved Hide resolved
@bnshr bnshr changed the title feat : Proper operator installation inside tenant namespace feat : (SingleNamespaced) Operator Installation in tenant namespace Jan 24, 2025
@bnshr bnshr changed the title feat : (SingleNamespaced) Operator Installation in tenant namespace feat : Valid (SingleNamespaced) Operator Installation in tenant namespace Jan 24, 2025
@dcibot
Copy link
Collaborator

dcibot commented Jan 24, 2025

from change #2589:

@dcibot
Copy link
Collaborator

dcibot commented Jan 24, 2025

from change #2589:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@greyerof greyerof greyerof left review comments

@edcdavid edcdavid edcdavid left review comments

@sebrandon1 sebrandon1 sebrandon1 left review comments

At least 2 approving reviews are required to merge this pull request.

Assignees
No one assigned
Labels
v1.6 BP Update
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@bnshr @dcibot @sebrandon1 @edcdavid @greyerof