Skip to content

WIP: Add delete annotation to default crb#1366

Draft
DavidHurta wants to merge 2 commits intoopenshift:mainfrom
DavidHurta:add-delete-annotation-to-default-crb
Draft

WIP: Add delete annotation to default crb#1366
DavidHurta wants to merge 2 commits intoopenshift:mainfrom
DavidHurta:add-delete-annotation-to-default-crb

Conversation

@DavidHurta
Copy link
Copy Markdown
Contributor

@DavidHurta DavidHurta commented Apr 1, 2026

No description provided.

@DavidHurta
Remove cluster role binding referencing default service account
da46ec5 
To ensure the default SA does not have cluster admin permissions.

To achieve this, rendering logic needs to be updated as well. During
cluster bootstrap, the installer calls rendering commands of specific
components required for the bootstrap [1]. These rendered manifests are
then applied by the cluster-bootstrap component [2]. The
cluster-bootstrap component applies all the non-bootstrap manifests as
they are [3].

At no stage is the delete annotation [4] taken into account, and thus
the CRB would keep getting applied during installations and getting
removed only during cluster upgrades due to the annotation.
This would prohibit us from ever removing the manifest file from the
repository, as a freshly installed cluster upgrading to a version where
manifest does not exist would result in the CRB being applied till
manually removed, causing a security concern.

Teach the rendering command to respect the delete annotation to allow us
to remove such manifests.

[1]: https://github.com/openshift/installer/blob/c93ae9fc74d7fa0f478fa250de2ba702f84a0a21/data/data/bootstrap/files/usr/local/bin/bootkube.sh.template
[2]: https://github.com/openshift/installer/blob/c93ae9fc74d7fa0f478fa250de2ba702f84a0a21/data/data/bootstrap/files/usr/local/bin/bootkube.sh.template#L576
[3]: https://github.com/openshift/cluster-bootstrap/blob/b23c6ce3df43aed15158e999239694ec75371f18/pkg/start/start.go#L142
[4]: https://github.com/openshift/enhancements/blob/master/enhancements/update/object-removal-manifest-annotation.md
@DavidHurta
bootstrap: Add additional context of bootstrap pod manifest in comments
5fe6918 
The installer renders the CVO bootstrap manifests into its
bootstrap-manifests directory [1], where bootstrap manifests of other
related componenets are rendered as well by their respective bootstrap
commands.

The directory is then consumed by the cluster-bootstrap component [2].
The cluster-bootstrap component copies these manifests to the static
Pod path of the node's kubelet [3].

As such, static Pods have some notable details, such as:

> The spec of a static Pod cannot refer to other API objects
> (e.g., ServiceAccount, ConfigMap, Secret, etc). [4]

Mention this in the manifest to save some time for future developers.

[1]: https://github.com/openshift/installer/blob/c93ae9fc74d7fa0f478fa250de2ba702f84a0a21/data/data/bootstrap/files/usr/local/bin/bootkube.sh.template#L192
[2]: https://github.com/openshift/installer/blob/c93ae9fc74d7fa0f478fa250de2ba702f84a0a21/data/data/bootstrap/files/usr/local/bin/bootkube.sh.template#L576
[3]: https://github.com/openshift/cluster-bootstrap/blob/dc0d4a5cdaf8a7477cab584208dc99352f46efe2/pkg/start/bootstrap.go#L52-L60
[4]: https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/
@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Apr 1, 2026
@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci bot commented Apr 1, 2026

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@DavidHurta
Copy link
Copy Markdown
Contributor Author

DavidHurta commented Apr 1, 2026

/test all

@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Apr 1, 2026 •
edited
Loading

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Review skipped — only excluded labels are configured. (1)
  • do-not-merge/work-in-progress

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 63406c8b-8ba7-4367-aa29-caba79646e3e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands and usage tips.

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci bot commented Apr 1, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: DavidHurta

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 1, 2026
@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci bot commented Apr 1, 2026

@DavidHurta: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-agnostic-ovn-techpreview-serial-1of3 5fe6918 link true /test e2e-agnostic-ovn-techpreview-serial-1of3
ci/prow/e2e-hypershift-conformance 5fe6918 link true /test e2e-hypershift-conformance
ci/prow/e2e-agnostic-ovn-techpreview-serial-2of3 5fe6918 link true /test e2e-agnostic-ovn-techpreview-serial-2of3

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@DavidHurta