[reproducer] Enable CSR auto-approval when waiting for OCP stability#4027
[reproducer] Enable CSR auto-approval when waiting for OCP stability#4027abays wants to merge 1 commit into
Conversation
When reusing an existing OpenShift cluster (e.g. after `reproducer-clean.yml` without `--tags deepscrub`), the reproducer calls `openshift_adm` with `op: stable` to wait for the cluster to come back. The `wait_for_cluster.yml` task file already contains a block that auto-approves pending certificate signing requests via the `cifmw.general.approve_csr` module, but that block is gated by `_openshift_adm_check_cert_approve`, which defaults to `false`. The `devscripts` role sets this flag during its own golden-image verification flow, but the reproducer role calls `openshift_adm` directly — bypassing that path entirely. As a result, CSRs that appear after a cluster restart (kubelet client/server certs) are never approved, causing the MachineConfigPool wait to hang indefinitely. Pass `_openshift_adm_check_cert_approve: true` from both reproducer entry points (`main.yml` and `reuse_main.yaml`) so that pending CSRs are automatically approved during the cluster stability wait. Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Andrew Bays <abays@redhat.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
| cifmw_openshift_adm_op: "stable" | ||
| cifmw_openshift_kubeconfig: >- | ||
| {{ (_auth_path, 'kubeconfig') | ansible.builtin.path_join }} | ||
| _openshift_adm_check_cert_approve: true |
There was a problem hiding this comment.
Not necessarily blocking but IIUC including this flag here means that greenfield deployments will have an additional 3 minutes of unnecessary time added as they wait for the approve_csr module to run through the complete quiet_period. Correct me if I'm wrong on that, but if that is the case, would it be possible to avoid including this flag in the greenfield case?
2 participants
When reusing an existing OpenShift cluster (e.g. after
reproducer-clean.ymlwithout--tags deepscrub), the reproducer callsopenshift_admwithop: stableto wait for the cluster to come back. Thewait_for_cluster.ymltask file already contains a block that auto-approves pending certificate signing requests via thecifmw.general.approve_csrmodule, but that block is gated by_openshift_adm_check_cert_approve, which defaults tofalse.The
devscriptsrole sets this flag during its own golden-image verification flow, but the reproducer role callsopenshift_admdirectly — bypassing that path entirely. As a result, CSRs that appear after a cluster restart (kubelet client/server certs) are never approved, causing the MachineConfigPool wait to hang indefinitely.Pass
_openshift_adm_check_cert_approve: truefrom both reproducer entry points (main.ymlandreuse_main.yaml) so that pending CSRs are automatically approved during the cluster stability wait.Co-authored-by: Cursor cursoragent@cursor.com
Signed-off-by: Andrew Bays abays@redhat.com