Repository navigation
ACM-38894: Fixed RBAC for consolenotification - #3784
Merged
openshift-merge-bot[bot] merged 5 commits intoAug 4, 2026
Merged
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository: stolostron/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Add consolenotifications to the console.openshift.io RBAC resources in the CSV to match the existing kubebuilder marker in backplaneconfig_controller.go, needed for the create/get/update/patch/ delete operations performed on the OCP compliance ConsoleNotification banner. Also fix cleanupConsoleNotifications to remove the banner by name (Get+Delete) instead of DeleteAllOf, since DeleteAllOf requires the cluster-scoped deletecollection verb, which is intentionally not granted (only one ConsoleNotification is ever created by this operator, so no collection delete is needed). Signed-off-by: Nathaniel Graham <ngraham@redhat.com>
Signed-off-by: Nathaniel Graham <ngraham@redhat.com>
Signed-off-by: Nathaniel Graham <ngraham@redhat.com>
Signed-off-by: Nathaniel Graham <ngraham@redhat.com>
Collaborator
|
/lgtm |
Contributor
Author
|
/retest |
The reconciler uses the manager's cached client, while test assertions use a direct client against the API server. Several Eventually blocks retried the reconciler call and the assertion separately, so a no-op reconciler call (returned nil because the cache hadn't yet observed a test-created/updated object) satisfied the first Eventually on its first attempt without performing the expected create/update/delete, causing the second Eventually to time out waiting on a change that would never happen. Combine the reconciler call and its resulting assertion into a single polled closure so retries continue until the cache catches up and the reconciler actually performs the mutation, and bump the timeout to 5s. Signed-off-by: Nathaniel Graham <ngraham@redhat.com>
Collaborator
|
/lgtm |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dislbenn, ngraham20 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
openshift-merge-bot
Bot
merged commit Aug 4, 2026
ccc6706
into
stolostron:backplane-2.11
9 checks passed
1 of 4 tasks
kaovilai
added a commit
to kaovilai/oadp-operator
that referenced
this pull request
Aug 25, 2026
Corrects a comment left stating the already-refuted CVE-2026-66808 explanation as fact; it now describes the actual OCP-version-floor mechanism traced to stolostron/backplane-operator#3784. Adds CheckMCEOperatorFailureSignature (tests/e2e/lib/hcp/mce.go): after a 45s warm-up, checks MCE operator pod logs for a log line repeating at least 3 times (distinguishing a deterministic block from transient noise, without hardcoding this incident's specific wording) and, if found, exits the HyperShift-operator wait immediately instead of blocking for the full 10-minute timeout. Falls through to the existing CSV-fallback path either way. Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
kaovilai
added a commit
to kaovilai/oadp-operator
that referenced
this pull request
Aug 25, 2026
Confirmed with the MCE team that the OCP 4.19 minimum introduced in stolostron/backplane-operator#3784 is intentional: MCE 2.11 doesn't officially support OCP 4.18, only via the unsupported support-exception path. Floating on the 4.18 catalog's default channel (currently stable-2.11) was always going to hit this eventually. More importantly, our actual GovCloud HCP target doesn't run MCE 2.11 at all -- it's ACM 2.13 / MCE 2.8 today, moving to ACM ~2.15 later. Pin the test's MCE Subscription to channel stable-2.8 explicitly so it tracks what we actually need to validate against, instead of whatever the 4.18 index's default channel happens to resolve to. The dynamic patch-fallback and fail-fast log-watch mechanisms added in prior commits are kept as defense-in-depth within the now-pinned channel, in case a future stable-2.8 patch introduces some other problem -- but the specific OCP-version-floor issue this PR was originally about no longer applies once the channel itself is pinned to a version the target environment actually supports. Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
kaovilai
added a commit
to kaovilai/oadp-operator
that referenced
this pull request
Aug 25, 2026
periodic-ci-openshift-oadp-operator-oadp-1.6-4.18-e2e-test-hcp-aws-periodic
was failing in the HCP suite's BeforeAll ("deployments.apps \"operator\"
not found" after a 600s timeout): MCE v2.11.5's backplane-operator
reconciler hard-rejects the MultiClusterEngine CR with a hardcoded
minimum-OpenShift-version check ("OCP version ... did not meet minimum
version requirement of 4.19.0"), confirmed via must-gather from a
failed run. This fires before any managed component -- including the
HyperShift operator Deployment -- is created, while MCE's own operator
Deployment/CSV report Ready/Succeeded normally. Traced to
stolostron/backplane-operator#3784.
Confirmed with the MCE team this is intentional, not a bug: MCE 2.11
(ACM 2.16) doesn't officially support OCP 4.18, only via an unsupported
support-exception path. More importantly, our actual GovCloud HCP
target environment doesn't run MCE 2.11 at all -- it's currently
ACM 2.13 / MCE 2.8, moving to ACM ~2.15 later (ROSAENG-58373). The MCE
Subscription had no Channel set, so it floated onto whatever the 4.18
catalog's default channel resolved to, rather than the version we
actually need to validate against.
Pin the MCE Subscription to Channel: "stable-2.8" explicitly, matching
the real target. Also extend DumpHypershiftDiagnostics to capture MCE
operator pod logs (filtered to a small keyword allowlist) plus
MultiClusterEngine CR conditions/components and namespace pod/event
listings -- none of this was previously captured by CI artifacts, and
would have made this much faster to diagnose.
Fixes: OADP-8716
See also: OADP-7564, ROSAENG-58373
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
openshift-cherrypick-robot
pushed a commit
to openshift-cherrypick-robot/oadp-operator
that referenced
this pull request
Aug 25, 2026
periodic-ci-openshift-oadp-operator-oadp-1.6-4.18-e2e-test-hcp-aws-periodic
was failing in the HCP suite's BeforeAll ("deployments.apps \"operator\"
not found" after a 600s timeout): MCE v2.11.5's backplane-operator
reconciler hard-rejects the MultiClusterEngine CR with a hardcoded
minimum-OpenShift-version check ("OCP version ... did not meet minimum
version requirement of 4.19.0"), confirmed via must-gather from a
failed run. This fires before any managed component -- including the
HyperShift operator Deployment -- is created, while MCE's own operator
Deployment/CSV report Ready/Succeeded normally. Traced to
stolostron/backplane-operator#3784.
Confirmed with the MCE team this is intentional, not a bug: MCE 2.11
(ACM 2.16) doesn't officially support OCP 4.18, only via an unsupported
support-exception path. More importantly, our actual GovCloud HCP
target environment doesn't run MCE 2.11 at all -- it's currently
ACM 2.13 / MCE 2.8, moving to ACM ~2.15 later (ROSAENG-58373). The MCE
Subscription had no Channel set, so it floated onto whatever the 4.18
catalog's default channel resolved to, rather than the version we
actually need to validate against.
Pin the MCE Subscription to Channel: "stable-2.8" explicitly, matching
the real target. Also extend DumpHypershiftDiagnostics to capture MCE
operator pod logs (filtered to a small keyword allowlist) plus
MultiClusterEngine CR conditions/components and namespace pod/event
listings -- none of this was previously captured by CI artifacts, and
would have made this much faster to diagnose.
Fixes: OADP-8716
See also: OADP-7564, ROSAENG-58373
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.