Fail Helm install and operator runtime on Kubernetes 1.25 (#3474)

* Fail Helm install and operator runtime on Kubernetes 1.25

Author: rjeberhard

kubernetes/charts/weblogic-operator/templates/_validate-inputs.tpl

@@ -1,4 +1,4 @@
-# Copyright (c) 2018, 2021, Oracle and/or its affiliates.
+# Copyright (c) 2018, 2022, Oracle and/or its affiliates.
 # Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
 
 {{- define "operator.validateInputs" -}}
@@ -7,6 +7,10 @@
 {{- $ignore := include "utils.pushValidationContext" (list $scope "Release") -}}
 {{- $ignore := include "utils.verifyResourceName" (list $scope "Namespace" 63) -}}
 {{- $ignore := include "utils.popValidationContext" $scope -}}
+{{- if not (.APIVersions.Has "policy/v1beta1") }}
+{{-   $errorMsg := "Kubernetes version must be between 1.19 and 1.24." -}}
+{{-   include "utils.recordValidationError" (list $scope $errorMsg) -}}
+{{- end -}}
 {{- $ignore := include "utils.verifyString" (list $scope "serviceAccount") -}}
 {{- $ignore := include "utils.verifyK8SResource" (list $scope .serviceAccount "ServiceAccount" .Release.Namespace) -}}
 {{- $ignore := include "utils.verifyString" (list $scope "image") -}}

operator/src/main/java/oracle/kubernetes/operator/helpers/HealthCheckHelper.java

@@ -1,4 +1,4 @@
-// Copyright (c) 2017, 2021, Oracle and/or its affiliates.
+// Copyright (c) 2017, 2022, Oracle and/or its affiliates.
 // Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
 
 package oracle.kubernetes.operator.helpers;
@@ -78,9 +78,6 @@ public final class HealthCheckHelper {
       Operation.patch
   };
 
-  // default namespace or svc account name
-  private static final String DEFAULT_NAMESPACE = "default";
-
   static {
     clusterAccessChecks.put(Resource.NAMESPACES, glwOperations);
     clusterAccessChecks.put(Resource.CRDS, crdOperations);
@@ -218,7 +215,9 @@ public static KubernetesVersion performK8sVersionCheck() {
       CallBuilder cb = new CallBuilder();
       return createAndValidateKubernetesVersion(
           cb.executeSynchronousCallWithRetry(cb::readVersionCode,
-          TuningParameters.getInstance().getMainTuning().initializationRetryDelaySeconds));
+              TuningParameters.getInstance().getMainTuning().initializationRetryDelaySeconds));
+    } catch (IllegalStateException ise) {
+      throw ise;
     } catch (Throwable t) {
       LOGGER.warning(MessageKeys.K8S_VERSION_CHECK_FAILURE, t);
       return KubernetesVersion.UNREADABLE;
@@ -236,6 +235,11 @@ private static KubernetesVersion createAndValidateKubernetesVersion(VersionInfo
     } else {
       LOGGER.info(MessageKeys.K8S_VERSION_CHECK, kubernetesVersion.asDisplayString());
     }
+
+    if (kubernetesVersion.isTooHigh()) {
+      throw new IllegalStateException(LOGGER.formatMessage(MessageKeys.K8S_VERSION_TOO_HIGH,
+              KubernetesVersion.TOO_HIGH.asDisplayString(), kubernetesVersion.asDisplayString()));
+    }
     return kubernetesVersion;
   }
 }

operator/src/main/java/oracle/kubernetes/operator/helpers/KubernetesVersion.java

@@ -8,6 +8,8 @@
 /** Major and minor version of Kubernetes API Server. */
 public class KubernetesVersion extends SemanticVersion {
   private static final String[] MINIMUM_K8S_VERSIONS = {"1.19.15", "1.20.11", "1.21.5", "1.22.5", "1.23.4", "1.24.0"};
+  static final KubernetesVersion TOO_HIGH = new KubernetesVersion(1, 25);
+
   static final KubernetesVersion UNREADABLE = new KubernetesVersion(0, 0);
   private final String version;
 
@@ -58,6 +60,10 @@ boolean isCompatible() {
     return numHigher == MINIMUM_K8S_VERSIONS.length;
   }
 
+  boolean isTooHigh() {
+    return compareTo(TOO_HIGH) >= 0;
+  }
+
   boolean isPublishNotReadyAddressesSupported() {
     return getMajor() > 1 || (getMajor() == 1 && getMinor() >= 8);
   }

operator/src/main/java/oracle/kubernetes/operator/logging/MessageKeys.java

@@ -52,6 +52,7 @@ public class MessageKeys {
   public static final String APIEXCEPTION_FROM_SUBJECT_ACCESS_REVIEW = "WLSKO-0069";
   public static final String REPLICA_MORE_THAN_WLS_SERVERS = "WLSKO-0071";
   public static final String K8S_VERSION_TOO_LOW = "WLSKO-0073";
+  public static final String K8S_VERSION_TOO_HIGH = "WLSKO-0228";
   public static final String VERIFY_K8S_MIN_VERSION = "WLSKO-0074";
   public static final String DOMAIN_UID_UNIQUENESS_FAILED = "WLSKO-0076";
   public static final String PV_NOT_FOUND_FOR_DOMAIN_UID = "WLSKO-0077";

operator/src/main/resources/Operator.properties

@@ -153,6 +153,7 @@ WLSKO-0224=Fluentd configmap created.
 WLSKO-0225=Fluentd configmap replaced.
 WLSKO-0226=Pod {0} was evicted due to {1}; validating domain
 WLSKO-0227=Pod {0} was evicted due to {1} but the operator is configured not to restart it.
+WLSKO-0228=Kubernetes maximum version check failed. Kubernetes version must be prior to {0}, but found version {1}
 
 # Domain status messages
 

operator/src/test/java/oracle/kubernetes/operator/helpers/VersionCheckTest.java

@@ -14,20 +14,24 @@
 import oracle.kubernetes.utils.TestUtils;
 import org.hamcrest.Description;
 import org.hamcrest.Matcher;
+import org.hamcrest.TypeSafeMatcher;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.Arguments;
 import org.junit.jupiter.params.provider.MethodSource;
 
+import static oracle.kubernetes.operator.helpers.VersionCheckTest.FailsWithMatcher.failsWith;
 import static oracle.kubernetes.operator.helpers.VersionCheckTest.TestType.LOG_MSG_TEST;
 import static oracle.kubernetes.operator.helpers.VersionCheckTest.TestType.VERSION_TEST;
+import static oracle.kubernetes.operator.helpers.VersionCheckTest.TestType.VERSION_TOO_HIGH_TEST;
 import static oracle.kubernetes.operator.helpers.VersionCheckTest.VersionMatcher.returnsVersion;
 import static oracle.kubernetes.operator.logging.MessageKeys.K8S_VERSION_CHECK;
 import static oracle.kubernetes.operator.logging.MessageKeys.K8S_VERSION_CHECK_FAILURE;
 import static oracle.kubernetes.operator.logging.MessageKeys.K8S_VERSION_TOO_LOW;
-import static oracle.kubernetes.utils.LogMatcher.containsInfo;
 import static oracle.kubernetes.utils.LogMatcher.containsWarning;
+import static org.hamcrest.Matchers.allOf;
+import static org.hamcrest.Matchers.instanceOf;
 import static org.hamcrest.junit.MatcherAssert.assertThat;
 
 class VersionCheckTest {
@@ -62,8 +66,8 @@ private static Stream<Arguments> getTestParams() {
           Arguments.of(VERSION_TEST, "1", "21", "10", returnsVersion(1, 21), ignoring(K8S_VERSION_CHECK)),
           Arguments.of(VERSION_TEST, "1", "22", "5", returnsVersion(1, 22), ignoring(K8S_VERSION_CHECK)),
           Arguments.of(VERSION_TEST, "1", "23", "7", returnsVersion(1, 23), ignoring(K8S_VERSION_CHECK)),
-          Arguments.of(VERSION_TEST, "2", "7", "", returnsVersion(2, 7), ignoring(K8S_VERSION_CHECK)),
-          Arguments.of(LOG_MSG_TEST, "2", "", "", containsInfo(K8S_VERSION_CHECK), noIgnores())
+          Arguments.of(VERSION_TOO_HIGH_TEST, "1", "25", "", null, ignoring(K8S_VERSION_CHECK)),
+          Arguments.of(VERSION_TOO_HIGH_TEST, "2", "7", "", null, ignoring(K8S_VERSION_CHECK))
         );
   }
 
@@ -134,6 +138,12 @@ void runTest(List<LogRecord> logRecords, Matcher matcher) {
       void runTest(List<LogRecord> logRecords, Matcher matcher) {
         assertThat(HealthCheckHelper.performK8sVersionCheck(), matcher);
       }
+    },
+    VERSION_TOO_HIGH_TEST {
+      @Override
+      void runTest(List<LogRecord> logRecords, Matcher matcher) {
+        assertThat(HealthCheckHelper::performK8sVersionCheck, failsWith(IllegalStateException.class));
+      }
     };
 
     abstract void runTest(List<LogRecord> logRecords, Matcher matcher);
@@ -172,4 +182,42 @@ public void describeTo(Description description) {
       describe(description, expectedMajor, expectedMinor);
     }
   }
+
+  @FunctionalInterface
+  public interface IThrowingRunnable<E extends Throwable> {
+    void run() throws E;
+  }
+
+  static class FailsWithMatcher<E extends Throwable> extends TypeSafeMatcher<IThrowingRunnable<E>> {
+    private final Matcher<? super E> matcher;
+
+    private FailsWithMatcher(final Matcher<? super E> matcher) {
+      this.matcher = matcher;
+    }
+
+    public static <E extends Throwable> Matcher<IThrowingRunnable<E>> failsWith(final Class<E> throwableType) {
+      return new FailsWithMatcher<>(instanceOf(throwableType));
+    }
+
+    public static <E extends Throwable> Matcher<IThrowingRunnable<E>> failsWith(
+            final Class<E> throwableType, final Matcher<? super E> throwableMatcher) {
+      return new FailsWithMatcher<>(allOf(instanceOf(throwableType), throwableMatcher));
+    }
+
+    @Override
+    protected boolean matchesSafely(final IThrowingRunnable<E> runnable) {
+      try {
+        runnable.run();
+        return false;
+      } catch (final Throwable ex) {
+        return matcher.matches(ex);
+      }
+    }
+
+    @Override
+    public void describeTo(final Description description) {
+      description.appendText("fails with ").appendDescriptionOf(matcher);
+    }
+
+  }
 }