fix(approve-installplan): version-gate InstallPlan approval against p…#80
Merged
Conversation
…inned startingCSV The Job could auto-approve an InstallPlan for a newer CSV than what pin-version pins. OLM treats startingCSV as a floor, not a ceiling — if the catalog offers a higher version in the same channel, OLM resolves to that version and the Job blindly approves it, causing version drift. Read the Subscription's spec.startingCSV before polling. When set, only approve InstallPlans whose clusterServiceVersionNames list contains the pinned CSV; fail fast with a clear error when a wrong-version InstallPlan is found. When startingCSV is not set (no pin-version component), fall back to the original behavior. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…etection The previous check (`oc get openstack openstack`) races with the openstack-operator-cr ArgoCD app which creates the OpenStack CR before the Job reaches its detection logic. On initial install this causes the Job to enter wait_for_new_version, which times out because deployedVersion is not set until the full controlplane deploys. Check OpenStackVersion.status.deployedVersion instead: if absent, this is an initial install (wait_for_crd); if present, it is a genuine update (wait_for_new_version). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
cjeanner
force-pushed
the
fix/version-gated-installplan-approval
branch
from
July 20, 2026 07:35
78985ff to
0a253ce
Compare
cjeanner
marked this pull request as ready for review
July 20, 2026 09:35
cjeanner
enabled auto-merge (squash)
July 20, 2026 09:35
aharivel
approved these changes
Jul 20, 2026
aharivel
left a comment
aharivel
left a comment
There was a problem hiding this comment.
Minor nits (non-blocking)
- Double API call on mismatch (job.yaml ~L73-86) — when pinned CSV isn't found, it fetches all InstallPlans again to check for a wrong-version plan. Could cache the first oc get installplan result in a variable and reuse it. Only matters during mismatch, but it's two full API calls per retry iteration.
- Immediate exit 1 on wrong-version plan (job.yaml ~L88) — if a wrong-version InstallPlan appears momentarily before the correct one, job dies with no retry. Unlikely but possible if catalog index is slow. Could wait a few iterations before failing.
- Stale RBAC for openstacks — the old code used oc get openstack openstack which needed openstacks get/list permission. After this PR that codepath is gone, but the RBAC rule for operator.openstack.org/openstacks remains in rbac.yaml. Minor cleanup opportunity.
Collaborator
Author
We can refine it - though this specific job is mostly for CI. There's room for improvement anyway. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…inned startingCSV
The Job could auto-approve an InstallPlan for a newer CSV than what pin-version pins. OLM treats startingCSV as a floor, not a ceiling — if the catalog offers a higher version in the same channel, OLM resolves to that version and the Job blindly approves it, causing version drift.
Read the Subscription's spec.startingCSV before polling. When set, only approve InstallPlans whose clusterServiceVersionNames list contains the pinned CSV; fail fast with a clear error when a wrong-version InstallPlan is found. When startingCSV is not set (no pin-version component), fall back to the original behavior.