Skip to content

Commit bcad208

Browse files
djoshydjoshy
committed
cross-validate boot images & skew enforcement
1 parent de95768 commit bcad208

File tree

7 files changed

+360
-1
lines changed

7 files changed

+360
-1
lines changed

‎operator/v1/tests/machineconfigurations.operator.openshift.io/BootImageSkewEnforcement.yaml‎

Lines changed: 262 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,12 @@ tests:
220220
kind: MachineConfiguration
221221
spec: {}
222222
status:
223+
managedBootImagesStatus:
224+
machineManagers:
225+
- resource: machinesets
226+
apiGroup: machine.openshift.io
227+
selection:
228+
mode: All
223229
bootImageSkewEnforcementStatus:
224230
mode: Automatic
225231
automatic:
@@ -232,8 +238,263 @@ tests:
232238
logLevel: Normal
233239
operatorLogLevel: Normal
234240
status:
241+
managedBootImagesStatus:
242+
machineManagers:
243+
- resource: machinesets
244+
apiGroup: machine.openshift.io
245+
selection:
246+
mode: All
235247
bootImageSkewEnforcementStatus:
236248
mode: Automatic
237249
automatic:
238250
ocpVersion: "4.18.2"
239-
rhcosVersion: "416.94.202411201433-0"
251+
rhcosVersion: "416.94.202411201433-0"
252+
- name: Should require boot image configuration to be set to All when bootImageSkewEnforcementStatus.mode is Automatic
253+
initial: |
254+
apiVersion: operator.openshift.io/v1
255+
kind: MachineConfiguration
256+
spec: {}
257+
status:
258+
managedBootImagesStatus:
259+
machineManagers:
260+
- resource: machinesets
261+
apiGroup: machine.openshift.io
262+
selection:
263+
mode: All
264+
bootImageSkewEnforcementStatus:
265+
mode: Automatic
266+
automatic:
267+
ocpVersion: "4.18.2"
268+
rhcosVersion: "416.94.202411201433-0"
269+
updated: |
270+
apiVersion: operator.openshift.io/v1
271+
kind: MachineConfiguration
272+
spec:
273+
managedBootImages:
274+
machineManagers:
275+
- resource: machinesets
276+
apiGroup: machine.openshift.io
277+
selection:
278+
mode: None
279+
status:
280+
managedBootImagesStatus:
281+
machineManagers:
282+
- resource: machinesets
283+
apiGroup: machine.openshift.io
284+
selection:
285+
mode: All
286+
bootImageSkewEnforcementStatus:
287+
mode: Automatic
288+
automatic:
289+
ocpVersion: "4.18.2"
290+
rhcosVersion: "416.94.202411201433-0"
291+
expectedError: "when skew enforcement is in Automatic mode, managedBootImages must contain a MachineManager opting in all MachineAPI MachineSets"
292+
- name: Should not be able to set boot image configuration to an empty list if bootImageSkewEnforcementStatus.mode is set to Automatic
293+
initial: |
294+
apiVersion: operator.openshift.io/v1
295+
kind: MachineConfiguration
296+
spec: {}
297+
status:
298+
managedBootImagesStatus:
299+
machineManagers:
300+
- resource: machinesets
301+
apiGroup: machine.openshift.io
302+
selection:
303+
mode: All
304+
bootImageSkewEnforcementStatus:
305+
mode: Automatic
306+
automatic:
307+
ocpVersion: "4.18.2"
308+
rhcosVersion: "416.94.202411201433-0"
309+
updated: |
310+
apiVersion: operator.openshift.io/v1
311+
kind: MachineConfiguration
312+
spec:
313+
managedBootImages:
314+
machineManagers:
315+
[]
316+
status:
317+
managedBootImagesStatus:
318+
machineManagers:
319+
- resource: machinesets
320+
apiGroup: machine.openshift.io
321+
selection:
322+
mode: All
323+
bootImageSkewEnforcementStatus:
324+
mode: Automatic
325+
automatic:
326+
ocpVersion: "4.18.2"
327+
rhcosVersion: "416.94.202411201433-0"
328+
expectedError: "when skew enforcement is in Automatic mode, managedBootImages must contain a MachineManager opting in all MachineAPI MachineSets"
329+
- name: Should require boot image configuration status to be set to All when bootImageSkewEnforcementStatus.mode is Automatic
330+
initial: |
331+
apiVersion: operator.openshift.io/v1
332+
kind: MachineConfiguration
333+
spec: {}
334+
status:
335+
managedBootImagesStatus:
336+
machineManagers:
337+
- resource: machinesets
338+
apiGroup: machine.openshift.io
339+
selection:
340+
mode: All
341+
bootImageSkewEnforcementStatus:
342+
mode: Automatic
343+
automatic:
344+
ocpVersion: "4.18.2"
345+
rhcosVersion: "416.94.202411201433-0"
346+
updated: |
347+
apiVersion: operator.openshift.io/v1
348+
kind: MachineConfiguration
349+
spec: {}
350+
status:
351+
managedBootImagesStatus:
352+
machineManagers:
353+
- resource: machinesets
354+
apiGroup: machine.openshift.io
355+
selection:
356+
mode: None
357+
bootImageSkewEnforcementStatus:
358+
mode: Automatic
359+
automatic:
360+
ocpVersion: "4.18.2"
361+
rhcosVersion: "416.94.202411201433-0"
362+
expectedStatusError: "when skew enforcement is in Automatic mode, managedBootImagesStatus must contain a MachineManager opting in all MachineAPI MachineSets"
363+
- name: Should be able change boot image configuration if bootImageSkewEnforcementStatus.mode is set to Manual
364+
initial: |
365+
apiVersion: operator.openshift.io/v1
366+
kind: MachineConfiguration
367+
spec:
368+
bootImageSkewEnforcement:
369+
mode: Manual
370+
manual:
371+
ocpVersion: "4.18.2"
372+
rhcosVersion: "9.6.20250523-1"
373+
status:
374+
managedBootImagesStatus:
375+
machineManagers:
376+
- resource: machinesets
377+
apiGroup: machine.openshift.io
378+
selection:
379+
mode: All
380+
bootImageSkewEnforcementStatus:
381+
mode: Manual
382+
manual:
383+
ocpVersion: "4.18.2"
384+
rhcosVersion: "416.94.202411201433-0"
385+
updated: |
386+
apiVersion: operator.openshift.io/v1
387+
kind: MachineConfiguration
388+
spec:
389+
managedBootImages:
390+
machineManagers:
391+
- resource: machinesets
392+
apiGroup: machine.openshift.io
393+
selection:
394+
mode: None
395+
bootImageSkewEnforcement:
396+
mode: Manual
397+
manual:
398+
ocpVersion: "4.18.2"
399+
rhcosVersion: "9.6.20250523-1"
400+
status:
401+
managedBootImagesStatus:
402+
machineManagers:
403+
- resource: machinesets
404+
apiGroup: machine.openshift.io
405+
selection:
406+
mode: All
407+
bootImageSkewEnforcementStatus:
408+
mode: Manual
409+
manual:
410+
ocpVersion: "4.18.2"
411+
rhcosVersion: "416.94.202411201433-0"
412+
expected: |
413+
apiVersion: operator.openshift.io/v1
414+
kind: MachineConfiguration
415+
spec:
416+
logLevel: Normal
417+
operatorLogLevel: Normal
418+
managedBootImages:
419+
machineManagers:
420+
- resource: machinesets
421+
apiGroup: machine.openshift.io
422+
selection:
423+
mode: None
424+
bootImageSkewEnforcement:
425+
mode: Manual
426+
manual:
427+
ocpVersion: "4.18.2"
428+
rhcosVersion: "9.6.20250523-1"
429+
status:
430+
managedBootImagesStatus:
431+
machineManagers:
432+
- resource: machinesets
433+
apiGroup: machine.openshift.io
434+
selection:
435+
mode: All
436+
bootImageSkewEnforcementStatus:
437+
mode: Manual
438+
manual:
439+
ocpVersion: "4.18.2"
440+
rhcosVersion: "416.94.202411201433-0"
441+
- name: Should be able change boot image configuration if bootImageSkewEnforcementStatus.mode is set to None
442+
initial: |
443+
apiVersion: operator.openshift.io/v1
444+
kind: MachineConfiguration
445+
spec:
446+
bootImageSkewEnforcement:
447+
mode: None
448+
status:
449+
managedBootImagesStatus:
450+
machineManagers:
451+
- resource: machinesets
452+
apiGroup: machine.openshift.io
453+
selection:
454+
mode: All
455+
bootImageSkewEnforcementStatus:
456+
mode: None
457+
updated: |
458+
apiVersion: operator.openshift.io/v1
459+
kind: MachineConfiguration
460+
spec:
461+
managedBootImages:
462+
machineManagers:
463+
- resource: machinesets
464+
apiGroup: machine.openshift.io
465+
selection:
466+
mode: None
467+
bootImageSkewEnforcement:
468+
mode: None
469+
status:
470+
managedBootImagesStatus:
471+
machineManagers:
472+
- resource: machinesets
473+
apiGroup: machine.openshift.io
474+
selection:
475+
mode: All
476+
bootImageSkewEnforcementStatus:
477+
mode: None
478+
expected: |
479+
apiVersion: operator.openshift.io/v1
480+
kind: MachineConfiguration
481+
spec:
482+
logLevel: Normal
483+
operatorLogLevel: Normal
484+
managedBootImages:
485+
machineManagers:
486+
- resource: machinesets
487+
apiGroup: machine.openshift.io
488+
selection:
489+
mode: None
490+
bootImageSkewEnforcement:
491+
mode: None
492+
status:
493+
managedBootImagesStatus:
494+
machineManagers:
495+
- resource: machinesets
496+
apiGroup: machine.openshift.io
497+
selection:
498+
mode: All
499+
bootImageSkewEnforcementStatus:
500+
mode: None

‎operator/v1/types_machineconfiguration.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ import (
1717
//
1818
// Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
1919
// +openshift:compatibility-gen:level=1
20+
// +openshift:validation:FeatureGateAwareXValidation:featureGate=BootImageSkewEnforcement,rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? self.?spec.managedBootImages.hasValue() || self.?status.managedBootImagesStatus.hasValue() : true",message="when skew enforcement is in Automatic mode, a boot image configuration is required"
21+
// +openshift:validation:FeatureGateAwareXValidation:featureGate=BootImageSkewEnforcement,rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || self.spec.managedBootImages.machineManagers.exists(m, m.selection.mode == 'All' && m.resource == 'machinesets' && m.apiGroup == 'machine.openshift.io') : true",message="when skew enforcement is in Automatic mode, managedBootImages must contain a MachineManager opting in all MachineAPI MachineSets"
22+
// +openshift:validation:FeatureGateAwareXValidation:featureGate=BootImageSkewEnforcement,rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?status.managedBootImagesStatus.machineManagers.hasValue()) || self.status.managedBootImagesStatus.machineManagers.exists(m, m.selection.mode == 'All' && m.resource == 'machinesets' && m.apiGroup == 'machine.openshift.io'): true",message="when skew enforcement is in Automatic mode, managedBootImagesStatus must contain a MachineManager opting in all MachineAPI MachineSets"
2023
type MachineConfiguration struct {
2124
metav1.TypeMeta `json:",inline"`
2225

‎operator/v1/zz_generated.crd-manifests/0000_80_machine-config_01_machineconfigurations-CustomNoUpgrade.crd.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1460,6 +1460,25 @@ spec:
14601460
required:
14611461
- spec
14621462
type: object
1463+
x-kubernetes-validations:
1464+
- message: when skew enforcement is in Automatic mode, a boot image configuration
1465+
is required
1466+
rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic''
1467+
? self.?spec.managedBootImages.hasValue() || self.?status.managedBootImagesStatus.hasValue()
1468+
: true'
1469+
- message: when skew enforcement is in Automatic mode, managedBootImages must
1470+
contain a MachineManager opting in all MachineAPI MachineSets
1471+
rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic''
1472+
? !(self.?spec.managedBootImages.machineManagers.hasValue()) || self.spec.managedBootImages.machineManagers.exists(m,
1473+
m.selection.mode == ''All'' && m.resource == ''machinesets'' && m.apiGroup
1474+
== ''machine.openshift.io'') : true'
1475+
- message: when skew enforcement is in Automatic mode, managedBootImagesStatus
1476+
must contain a MachineManager opting in all MachineAPI MachineSets
1477+
rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic''
1478+
? !(self.?status.managedBootImagesStatus.machineManagers.hasValue()) ||
1479+
self.status.managedBootImagesStatus.machineManagers.exists(m, m.selection.mode
1480+
== ''All'' && m.resource == ''machinesets'' && m.apiGroup == ''machine.openshift.io''):
1481+
true'
14631482
served: true
14641483
storage: true
14651484
subresources:

‎operator/v1/zz_generated.crd-manifests/0000_80_machine-config_01_machineconfigurations-DevPreviewNoUpgrade.crd.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1460,6 +1460,25 @@ spec:
14601460
required:
14611461
- spec
14621462
type: object
1463+
x-kubernetes-validations:
1464+
- message: when skew enforcement is in Automatic mode, a boot image configuration
1465+
is required
1466+
rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic''
1467+
? self.?spec.managedBootImages.hasValue() || self.?status.managedBootImagesStatus.hasValue()
1468+
: true'
1469+
- message: when skew enforcement is in Automatic mode, managedBootImages must
1470+
contain a MachineManager opting in all MachineAPI MachineSets
1471+
rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic''
1472+
? !(self.?spec.managedBootImages.machineManagers.hasValue()) || self.spec.managedBootImages.machineManagers.exists(m,
1473+
m.selection.mode == ''All'' && m.resource == ''machinesets'' && m.apiGroup
1474+
== ''machine.openshift.io'') : true'
1475+
- message: when skew enforcement is in Automatic mode, managedBootImagesStatus
1476+
must contain a MachineManager opting in all MachineAPI MachineSets
1477+
rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic''
1478+
? !(self.?status.managedBootImagesStatus.machineManagers.hasValue()) ||
1479+
self.status.managedBootImagesStatus.machineManagers.exists(m, m.selection.mode
1480+
== ''All'' && m.resource == ''machinesets'' && m.apiGroup == ''machine.openshift.io''):
1481+
true'
14631482
served: true
14641483
storage: true
14651484
subresources:

‎operator/v1/zz_generated.featuregated-crd-manifests/machineconfigurations.operator.openshift.io/BootImageSkewEnforcement.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1174,6 +1174,25 @@ spec:
11741174
required:
11751175
- spec
11761176
type: object
1177+
x-kubernetes-validations:
1178+
- message: when skew enforcement is in Automatic mode, a boot image configuration
1179+
is required
1180+
rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic''
1181+
? self.?spec.managedBootImages.hasValue() || self.?status.managedBootImagesStatus.hasValue()
1182+
: true'
1183+
- message: when skew enforcement is in Automatic mode, managedBootImages must
1184+
contain a MachineManager opting in all MachineAPI MachineSets
1185+
rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic''
1186+
? !(self.?spec.managedBootImages.machineManagers.hasValue()) || self.spec.managedBootImages.machineManagers.exists(m,
1187+
m.selection.mode == ''All'' && m.resource == ''machinesets'' && m.apiGroup
1188+
== ''machine.openshift.io'') : true'
1189+
- message: when skew enforcement is in Automatic mode, managedBootImagesStatus
1190+
must contain a MachineManager opting in all MachineAPI MachineSets
1191+
rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic''
1192+
? !(self.?status.managedBootImagesStatus.machineManagers.hasValue()) ||
1193+
self.status.managedBootImagesStatus.machineManagers.exists(m, m.selection.mode
1194+
== ''All'' && m.resource == ''machinesets'' && m.apiGroup == ''machine.openshift.io''):
1195+
true'
11771196
served: true
11781197
storage: true
11791198
subresources:

‎payload-manifests/crds/0000_80_machine-config_01_machineconfigurations-CustomNoUpgrade.crd.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1460,6 +1460,25 @@ spec:
14601460
required:
14611461
- spec
14621462
type: object
1463+
x-kubernetes-validations:
1464+
- message: when skew enforcement is in Automatic mode, a boot image configuration
1465+
is required
1466+
rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic''
1467+
? self.?spec.managedBootImages.hasValue() || self.?status.managedBootImagesStatus.hasValue()
1468+
: true'
1469+
- message: when skew enforcement is in Automatic mode, managedBootImages must
1470+
contain a MachineManager opting in all MachineAPI MachineSets
1471+
rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic''
1472+
? !(self.?spec.managedBootImages.machineManagers.hasValue()) || self.spec.managedBootImages.machineManagers.exists(m,
1473+
m.selection.mode == ''All'' && m.resource == ''machinesets'' && m.apiGroup
1474+
== ''machine.openshift.io'') : true'
1475+
- message: when skew enforcement is in Automatic mode, managedBootImagesStatus
1476+
must contain a MachineManager opting in all MachineAPI MachineSets
1477+
rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic''
1478+
? !(self.?status.managedBootImagesStatus.machineManagers.hasValue()) ||
1479+
self.status.managedBootImagesStatus.machineManagers.exists(m, m.selection.mode
1480+
== ''All'' && m.resource == ''machinesets'' && m.apiGroup == ''machine.openshift.io''):
1481+
true'
14631482
served: true
14641483
storage: true
14651484
subresources:

0 commit comments

Comments
 (0)