Skip to content

[release-4.20] OCPBUGS-113989: [4.21] frr-k8s: use Recreate strategy for statuscleaner deployment - #3140

Closed
openshift-cherrypick-robot wants to merge 4 commits into
openshift:release-4.20from
openshift-cherrypick-robot:cherry-pick-3135-to-release-4.20
Closed

[release-4.20] OCPBUGS-113989: [4.21] frr-k8s: use Recreate strategy for statuscleaner deployment#3140
openshift-cherrypick-robot wants to merge 4 commits into
openshift:release-4.20from
openshift-cherrypick-robot:cherry-pick-3135-to-release-4.20

Conversation

@openshift-cherrypick-robot

Copy link
Copy Markdown

This is an automated cherry-pick of #3135

/assign andreaskaris

tpantelis and others added 4 commits August 25, 2026 19:07
This commit adds helper functions to testutil_test.go that are used
by component rendering tests to verify rendered Kubernetes objects:

- mustFindRenderedObj: Finds and converts unstructured objects using generics
- mustFindContainer: Finds a container by name in a container list
- findExecCommand: Extracts exec command strings from container command args

These utilities facilitate testing of rendered manifests and container
configurations across multiple components.

Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
Co-Authored-By: Ori Braunshtein <obraunsh@redhat.com>
(cherry picked from commit c617131)

Cherry-pick not clean:
- dropped definiton of mustFindContainer and findExecCommand (otherwise
  lint fails)

(cherry picked from commit cedf0d7)
The statuscleaner deployment uses hostNetwork with a fixed port (9123).
With the default RollingUpdate strategy, upgrades on SNO clusters get
stuck because the new pod cannot bind the host port already held by the
old pod. Switching to Recreate ensures the old pod is terminated before
the new one starts.

Signed-off-by: Federico Paolinelli <fpaoline@redhat.com>
Co-Authored-By: Ori Braunshtein <obraunsh@redhat.com>
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
(cherry picked from commit 3d86b75)

Cherry-pick not clean:
- added bootstrap result wiring to additionalRoutingCapibilities (that
  was already there for 5.0), aligned existing unit test with
  fakeBootstrapResult() as in 5.0

(cherry picked from commit a5752d9)

Conflicts:
	pkg/network/render.go preserving
Very small conflict due to the presence of isSupportedDualStackPlatform.
Resolution: keep isSupportedDualStackPlatform + add bootstrapResult to
renderAdditionalRoutingCapabilities.
On upgrade, the frr-k8s-statuscleaner Deployment has rollingUpdate
fields defaulted by the API server. SSA cannot remove fields it does
not own, so switching strategy.type to Recreate fails with:

    spec.strategy.rollingUpdate: Forbidden: may not be specified when
    strategy `type` is 'Recreate'

Add a generic pre-patch annotation:

    networkoperator.openshift.io/pre-patch

that applies a strategic-merge-patch to the live object before SSA. This
lets the template atomically set type=Recreate and remove rollingUpdate
in a single patch, before SSA takes over.

Also explicitly set strategy to RollingUpdate with rollingUpdate fields
on non-SNO clusters so that CNO owns these fields going forward,
preventing the issue from recurring in case we have to make the same
switch for non-SNO clusters in the future.

Signed-off-by: Andreas Karis <ak.karis@gmail.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
(cherry picked from commit 8ebb78e)
(cherry picked from commit d59aba6)
Add tests for ApplyObject's pre-patch behavior: strategic-merge-patch
runs before SSA, NotFound is tolerated, other errors stop reconciliation,
and objects without the annotation skip pre-patch entirely.

Remove fakeRESTMapper and replace it with
testrestmapper.TetsOnlyStaticRESTMapper to return a proper mapper,
and return scheme.Scheme from Scheme(). Both changes needed by
ApplyObject under test.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Andreas Karis <ak.karis@gmail.com>
(cherry picked from commit 6ca59b1)
(cherry picked from commit b1775c9)

Not clean cherry-pick:
Make the linter happy by applying the changes to pkg/apply from
openshift#3138. See
that PR for further details.
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@coderabbitai

coderabbitai Bot commented Aug 25, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d1df145d-cc1c-4d2f-894f-69435cedb2fc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Comment @coderabbitai help to get the list of available commands.

@openshift-ci
openshift-ci Bot requested review from miheer and oribon August 25, 2026 19:07
@andreaskaris

Copy link
Copy Markdown
Contributor

/pipeline required

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling required tests:
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-aws-ovn-upgrade
/test e2e-aws-ovn-upgrade-ipsec
/test e2e-aws-ovn-windows
/test e2e-azure-ovn-upgrade
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-dualstack-bgp
/test e2e-metal-ipi-ovn-dualstack-bgp-local-gw
/test e2e-metal-ipi-ovn-ipv6
/test e2e-metal-ipi-ovn-ipv6-ipsec
/test e2e-ovn-ipsec-step-registry
/test hypershift-e2e-aks

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test frrk8s-e2e

@openshift-ci-robot

Copy link
Copy Markdown
Contributor

@openshift-cherrypick-robot: Jira Issue OCPBUGS-112789 has been cloned as Jira Issue OCPBUGS-113989. Will retitle bug to link to clone.
/retitle [release-4.20] OCPBUGS-113989: [4.21] frr-k8s: use Recreate strategy for statuscleaner deployment

Details

In response to this:

This is an automated cherry-pick of #3135

/assign andreaskaris

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci Bot changed the title [release-4.20] OCPBUGS-112789: [4.21] frr-k8s: use Recreate strategy for statuscleaner deployment [release-4.20] OCPBUGS-113989: [4.21] frr-k8s: use Recreate strategy for statuscleaner deployment Aug 25, 2026
@openshift-ci-robot openshift-ci-robot added jira/severity-critical Referenced Jira bug's severity is critical for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Aug 25, 2026
@openshift-ci-robot

Copy link
Copy Markdown
Contributor

@openshift-cherrypick-robot: This pull request references Jira Issue OCPBUGS-113989, which is invalid:

  • expected dependent Jira Issue OCPBUGS-112789 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is MODIFIED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

This is an automated cherry-pick of #3135

/assign andreaskaris

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@andreaskaris

Copy link
Copy Markdown
Contributor

@jcaamano

@jcaamano

Copy link
Copy Markdown
Contributor

/lgtm
/approve
/label backport-risk-assessed

@openshift-ci openshift-ci Bot added the backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. label Aug 25, 2026
@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 25, 2026
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage.

@openshift-ci

openshift-ci Bot commented Aug 25, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jcaamano, openshift-cherrypick-robot

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 25, 2026
@andreaskaris

Copy link
Copy Markdown
Contributor
 I0825 19:14:45.179844   30434 ovn_kubernetes.go:1504] IP family change: updateNode=true, updateControlPlane=true
I0825 19:14:45.179945   30434 ovn_kubernetes.go:548] ovnk components: ovnkube-node: isRunning=false, update=true; ovnkube-control-plane: isRunning=false, update=true
2026/08/25 19:14:45 consoleplugins.console.openshift.io CRD was not found: customresourcedefinitions.apiextensions.k8s.io "consoleplugins.console.openshift.io" not found
2026/08/25 19:14:45 Starting render phase
2026/08/25 19:14:45 NOTICE: Unknown network type MyAwesomeThirdPartyPlugin, ignoring
W0825 19:14:45.276136   30434 node_identity.go:46] no status found in bootstrap configmap
I0825 19:14:45.276180   30434 node_identity.go:170] network-node-identity daemonset does not exist
I0825 19:14:45.286798   30434 node_identity.go:201] network-node-identity webhook will not be applied, bootstrap is not complete
I0825 19:14:45.286827   30434 node_identity.go:205] network-node-identity webhook will not be applied, CA bundle not found
I0825 19:14:45.286840   30434 node_identity.go:212] network-node-identity webhook will not be applied, the deployment/daemonset is not ready
I0825 19:14:45.286850   30434 node_identity.go:216] network-node-identity webhook will not be applied, if it already exists it won't be removed
2026/08/25 19:14:45 consoleplugins.console.openshift.io CRD does not exist yet
2026/08/25 19:14:45 Render phase done, rendered 87 objects
--- FAIL: Test_renderFRRStatusCleanerStrategy (0.04s)
    render_test.go:673: 
        Could not find object with kind "Deployment" and name "frr-k8s-statuscleaner"
        Expected
            <int>: -1
        not to equal
            <int>: -1
    --- FAIL: Test_renderFRRStatusCleanerStrategy/SNO:_strategy_is_Recreate (0.04s)
        testing.go:1679: test executed panic(nil) or runtime.Goexit: subtest may have called FailNow on a parent test
FAIL
FAIL	github.com/openshift/cluster-network-operator/pkg/network	18.538s
?   	github.com/openshift/cluster-network-operator/pkg/operator	[no test files]
?   	github.com/openshift/cluster-network-operator/pkg/platform	[no test files]
ok  	github.com/openshift/cluster-network-operator/pkg/render	1.040s
?   	github.com/openshift/cluster-network-operator/pkg/util	[no test files]

I guess I'll have to create a manual cherry-pick with a fix for that

@openshift-ci

openshift-ci Bot commented Aug 25, 2026

Copy link
Copy Markdown
Contributor

@openshift-cherrypick-robot: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-ovn-ipsec-step-registry 3fb37c1 link true /test e2e-ovn-ipsec-step-registry
ci/prow/e2e-aws-ovn-upgrade 3fb37c1 link true /test e2e-aws-ovn-upgrade
ci/prow/unit 3fb37c1 link true /test unit
ci/prow/security 3fb37c1 link false /test security

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@andreaskaris

Copy link
Copy Markdown
Contributor

/close

@openshift-ci openshift-ci Bot closed this Aug 26, 2026
@openshift-ci

openshift-ci Bot commented Aug 26, 2026

Copy link
Copy Markdown
Contributor

@andreaskaris: Closed this PR.

Details

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci-robot

Copy link
Copy Markdown
Contributor

@openshift-cherrypick-robot: This pull request references Jira Issue OCPBUGS-113989. The bug has been updated to no longer refer to the pull request using the external bug tracker.

Details

In response to this:

This is an automated cherry-pick of #3135

/assign andreaskaris

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. jira/severity-critical Referenced Jira bug's severity is critical for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants