[NFV] Configure provisioning operator to watch all namespaces

Set provisioning.watch_all_namespaces to true in the operator's configuration
during deployment.

Our CI was failing because the current process of patching the provisioning
configuration live was causing race conditions or instability.

Setting watch_all_namespaces to true from the start allows the provisioning
operator to correctly find and manage provisioning CRs across all namespaces,
which is required by NFV. This avoids the need for the unstable runtime
patch.

Jira: OSPRH-20407

Author: mnietoji

roles/openshift_setup/README.md

@@ -26,5 +26,4 @@ effect if `cifmw_openshift_setup_ca_registry_to_add` is set.
             mirrors:
               - mirror.quay.rdoproject.org
         ```
-* `cifmw_openshift_setup_metal3_watch_all_ns`: (Boolean) Tells Metal3 BMO to watch resources out of its namespace. Defaults to `false`.
 * `cifmw_openshift_setup_apply_marketplace_fix`: (Boolean) Apply openshift-marketplace workaround which is recreating all pods in the namespace. NOTE: same step is done in `base` job.

roles/openshift_setup/defaults/main.yml

@@ -24,7 +24,6 @@ cifmw_openshift_setup_skip_internal_registry: false
 cifmw_openshift_setup_skip_internal_registry_tls_verify: false
 cifmw_openshift_setup_ca_bundle_path: "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"
 cifmw_openshift_setup_digest_mirrors: []
-cifmw_openshift_setup_metal3_watch_all_ns: false
 cifmw_openshift_setup_operator_override_catalog_name: "redhat-operators-4.17"
 cifmw_openshift_setup_operator_override_catalog_namespace: "openshift-marketplace"
 cifmw_openshift_setup_operator_override_catalog_image: "registry.redhat.io/redhat/redhat-operator-index:v4.17"

roles/openshift_setup/tasks/main.yml

@@ -213,10 +213,6 @@
       spec:
         repositoryDigestMirrors: "{{ cifmw_openshift_setup_digest_mirrors }}"
 
-- name: Metal3 tweaks
-  when: not cifmw_openshift_setup_dry_run
-  ansible.builtin.include_tasks: metal3_config.yml
-
 - name: Patch network operator when using OVNKubernetes backend
   ansible.builtin.import_tasks: patch_network_operator.yml
 

roles/openshift_setup/tasks/metal3_config.yml

@@ -104,7 +104,8 @@ cifmw_config_bmh: true
 # BMH are deployed in a differnt NS than the secret OSP BMO
 # references in each BMH. Metal3 requires the referenced
 # secrets to be in the same NS or be allowed to access them
-cifmw_openshift_setup_metal3_watch_all_ns: true
+cifmw_devscripts_config_overrides_patch_bmo_watch_all_namespaces:
+  bmo_watch_all_namespaces: true
 
 # Use EDPM image for computes
 cifmw_update_containers_edpm_image_url: "{{ cifmw_update_containers_registry }}/{{ cifmw_update_containers_org }}/edpm-hardened-uefi:{{ cifmw_update_containers_tag }}"

scenarios/reproducers/dt-nfv-ovs-dpdk-sriov-2nodesets.yml

@@ -104,7 +104,8 @@ cifmw_config_bmh: true
 # BMH are deployed in a differnt NS than the secret OSP BMO
 # references in each BMH. Metal3 requires the referenced
 # secrets to be in the same NS or be allowed to access them
-cifmw_openshift_setup_metal3_watch_all_ns: true
+cifmw_devscripts_config_overrides_patch_bmo_watch_all_namespaces:
+  bmo_watch_all_namespaces: true
 
 # Use EDPM image for computes
 cifmw_update_containers_edpm_image_url: "{{ cifmw_update_containers_registry }}/{{ cifmw_update_containers_org }}/edpm-hardened-uefi:{{ cifmw_update_containers_tag }}"

scenarios/reproducers/dt-nfv-ovs-dpdk-sriov-hci.yml

@@ -104,7 +104,8 @@ cifmw_config_bmh: true
 # BMH are deployed in a differnt NS than the secret OSP BMO
 # references in each BMH. Metal3 requires the referenced
 # secrets to be in the same NS or be allowed to access them
-cifmw_openshift_setup_metal3_watch_all_ns: true
+cifmw_devscripts_config_overrides_patch_bmo_watch_all_namespaces:
+  bmo_watch_all_namespaces: true
 
 # Use EDPM image for computes
 cifmw_update_containers_edpm_image_url: "{{ cifmw_update_containers_registry }}/{{ cifmw_update_containers_org }}/edpm-hardened-uefi:{{ cifmw_update_containers_tag }}"

scenarios/reproducers/dt-nfv-ovs-dpdk-sriov-networker.yml

@@ -104,7 +104,8 @@ cifmw_config_bmh: true
 # BMH are deployed in a differnt NS than the secret OSP BMO
 # references in each BMH. Metal3 requires the referenced
 # secrets to be in the same NS or be allowed to access them
-cifmw_openshift_setup_metal3_watch_all_ns: true
+cifmw_devscripts_config_overrides_patch_bmo_watch_all_namespaces:
+  bmo_watch_all_namespaces: true
 
 # Use EDPM image for computes
 cifmw_update_containers_edpm_image_url: "{{ cifmw_update_containers_registry }}/{{ cifmw_update_containers_org }}/edpm-hardened-uefi:{{ cifmw_update_containers_tag }}"

scenarios/reproducers/va-nfv-ovs-dpdk-sriov.yml

@@ -104,7 +104,8 @@ cifmw_config_bmh: true
 # BMH are deployed in a differnt NS than the secret OSP BMO
 # references in each BMH. Metal3 requires the referenced
 # secrets to be in the same NS or be allowed to access them
-cifmw_openshift_setup_metal3_watch_all_ns: true
+cifmw_devscripts_config_overrides_patch_bmo_watch_all_namespaces:
+  bmo_watch_all_namespaces: true
 
 # Use EDPM image for computes
 cifmw_update_containers_edpm_image_url: "{{ cifmw_update_containers_registry }}/{{ cifmw_update_containers_org }}/edpm-hardened-uefi:{{ cifmw_update_containers_tag }}"

scenarios/reproducers/va-nfv-ovs-dpdk.yml

@@ -102,7 +102,8 @@ cifmw_config_bmh: true
 # BMH are deployed in a differnt NS than the secret OSP BMO
 # references in each BMH. Metal3 requires the referenced
 # secrets to be in the same NS or be allowed to access them
-cifmw_openshift_setup_metal3_watch_all_ns: true
+cifmw_devscripts_config_overrides_patch_bmo_watch_all_namespaces:
+  bmo_watch_all_namespaces: true
 
 # Use EDPM image for computes
 cifmw_update_containers_edpm_image_url: "{{ cifmw_update_containers_registry }}/{{ cifmw_update_containers_org }}/edpm-hardened-uefi:{{ cifmw_update_containers_tag }}"