diff --git a/features.md b/features.md index 3ef2130baf6..4237c7346b4 100644 --- a/features.md +++ b/features.md @@ -94,7 +94,6 @@ | AWSClusterHostedDNSInstall| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | AWSDualStackInstall| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | AdditionalStorageConfig| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | -| BootImageSkewEnforcement| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | BuildCSIVolumes| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | DualReplica| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | EVPN| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | diff --git a/features/features.go b/features/features.go index 23c455d2f6d..f0480e2b3d9 100644 --- a/features/features.go +++ b/features/features.go @@ -264,14 +264,6 @@ var ( enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() - FeatureGateBootImageSkewEnforcement = newFeatureGate("BootImageSkewEnforcement"). - reportProblemsToJiraComponent("MachineConfigOperator"). - contactPerson("djoshy"). - productScope(ocpSpecific). - enhancementPR("https://github.com/openshift/enhancements/pull/1761"). - enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). - mustRegister() - FeatureGateManagedBootImagesAWSCAPI = newFeatureGate("ManagedBootImagesAWSCAPI"). reportProblemsToJiraComponent("MachineConfigOperator"). contactPerson("djoshy"). diff --git a/operator/v1/tests/machineconfigurations.operator.openshift.io/BootImageSkewEnforcement+ManagedBootImagesCPMS.yaml b/operator/v1/tests/machineconfigurations.operator.openshift.io/BootImageSkewEnforcement+ManagedBootImagesCPMS.yaml index 810c35dd3f0..f7bce5791bc 100644 --- a/operator/v1/tests/machineconfigurations.operator.openshift.io/BootImageSkewEnforcement+ManagedBootImagesCPMS.yaml +++ b/operator/v1/tests/machineconfigurations.operator.openshift.io/BootImageSkewEnforcement+ManagedBootImagesCPMS.yaml @@ -2,7 +2,6 @@ apiVersion: apiextensions.k8s.io/v1 # Hack because controller-gen complains if w name: "MachineConfiguration" crdName: machineconfigurations.operator.openshift.io featureGates: -- BootImageSkewEnforcement - ManagedBootImagesCPMS tests: onUpdate: diff --git a/operator/v1/tests/machineconfigurations.operator.openshift.io/BootImageSkewEnforcement.yaml b/operator/v1/tests/machineconfigurations.operator.openshift.io/BootImageSkewEnforcement.yaml index 73d159d7eae..75ce54761b3 100644 --- a/operator/v1/tests/machineconfigurations.operator.openshift.io/BootImageSkewEnforcement.yaml +++ b/operator/v1/tests/machineconfigurations.operator.openshift.io/BootImageSkewEnforcement.yaml @@ -1,8 +1,6 @@ apiVersion: apiextensions.k8s.io/v1 # Hack because controller-gen complains if we don't have this name: "MachineConfiguration" crdName: machineconfigurations.operator.openshift.io -featureGates: -- BootImageSkewEnforcement tests: onCreate: - name: Should be able to create a minimal MachineConfiguration diff --git a/operator/v1/types_machineconfiguration.go b/operator/v1/types_machineconfiguration.go index 331c82f44dd..c7d5e29718a 100644 --- a/operator/v1/types_machineconfiguration.go +++ b/operator/v1/types_machineconfiguration.go @@ -17,10 +17,10 @@ import ( // // Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). // +openshift:compatibility-gen:level=1 -// +openshift:validation:FeatureGateAwareXValidation:featureGate=BootImageSkewEnforcement,rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? self.?spec.managedBootImages.hasValue() || self.?status.managedBootImagesStatus.hasValue() : true",message="when skew enforcement is in Automatic mode, a boot image configuration is required" -// +openshift:validation:FeatureGateAwareXValidation:featureGate=BootImageSkewEnforcement,rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || size(self.spec.managedBootImages.machineManagers) > 0 : true",message="when skew enforcement is in Automatic mode, managedBootImages.machineManagers must not be an empty list" -// +openshift:validation:FeatureGateAwareXValidation:featureGate=BootImageSkewEnforcement,rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || !self.spec.managedBootImages.machineManagers.exists(m, m.resource == 'machinesets' && m.apiGroup == 'machine.openshift.io') || self.spec.managedBootImages.machineManagers.exists(m, m.resource == 'machinesets' && m.apiGroup == 'machine.openshift.io' && m.selection.mode == 'All') : true",message="when skew enforcement is in Automatic mode, any MachineAPI MachineSet MachineManager must use selection mode 'All'" -// +openshift:validation:FeatureGateAwareXValidation:featureGate=BootImageSkewEnforcement,rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?status.managedBootImagesStatus.machineManagers.hasValue()) || self.status.managedBootImagesStatus.machineManagers.exists(m, m.selection.mode == 'All' && m.resource == 'machinesets' && m.apiGroup == 'machine.openshift.io'): true",message="when skew enforcement is in Automatic mode, managedBootImagesStatus must contain a MachineManager opting in all MachineAPI MachineSets" +// +kubebuilder:validation:XValidation:rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? self.?spec.managedBootImages.hasValue() || self.?status.managedBootImagesStatus.hasValue() : true",message="when skew enforcement is in Automatic mode, a boot image configuration is required" +// +kubebuilder:validation:XValidation:rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || size(self.spec.managedBootImages.machineManagers) > 0 : true",message="when skew enforcement is in Automatic mode, managedBootImages.machineManagers must not be an empty list" +// +kubebuilder:validation:XValidation:rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || !self.spec.managedBootImages.machineManagers.exists(m, m.resource == 'machinesets' && m.apiGroup == 'machine.openshift.io') || self.spec.managedBootImages.machineManagers.exists(m, m.resource == 'machinesets' && m.apiGroup == 'machine.openshift.io' && m.selection.mode == 'All') : true",message="when skew enforcement is in Automatic mode, any MachineAPI MachineSet MachineManager must use selection mode 'All'" +// +kubebuilder:validation:XValidation:rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?status.managedBootImagesStatus.machineManagers.hasValue()) || self.status.managedBootImagesStatus.machineManagers.exists(m, m.selection.mode == 'All' && m.resource == 'machinesets' && m.apiGroup == 'machine.openshift.io'): true",message="when skew enforcement is in Automatic mode, managedBootImagesStatus must contain a MachineManager opting in all MachineAPI MachineSets" type MachineConfiguration struct { metav1.TypeMeta `json:",inline"` @@ -74,7 +74,6 @@ type MachineConfigurationSpec struct { // a skew enforcement mode has been specified. // When version skew is being enforced, cluster upgrades will be disabled until the version skew is deemed // acceptable for the current release payload. - // +openshift:enable:FeatureGate=BootImageSkewEnforcement // +optional BootImageSkewEnforcement BootImageSkewEnforcementConfig `json:"bootImageSkewEnforcement,omitempty,omitzero"` } @@ -296,7 +295,6 @@ type MachineConfigurationStatus struct { // boot image skew should be enforced, cluster upgrades will be blocked until it can either automatically // determine skew enforcement or there is an explicit skew enforcement configuration provided in the // spec.bootImageSkewEnforcement field. - // +openshift:enable:FeatureGate=BootImageSkewEnforcement // +optional BootImageSkewEnforcementStatus BootImageSkewEnforcementStatus `json:"bootImageSkewEnforcementStatus,omitempty,omitzero"` } diff --git a/operator/v1/zz_generated.featuregated-crd-manifests.yaml b/operator/v1/zz_generated.featuregated-crd-manifests.yaml index 083bf4940c2..7dd0b8f1b63 100644 --- a/operator/v1/zz_generated.featuregated-crd-manifests.yaml +++ b/operator/v1/zz_generated.featuregated-crd-manifests.yaml @@ -311,7 +311,6 @@ machineconfigurations.operator.openshift.io: Capability: "" Category: "" FeatureGates: - - BootImageSkewEnforcement - IrreconcilableMachineConfig - ManagedBootImagesAWSCAPI - ManagedBootImagesCPMS diff --git a/operator/v1/zz_generated.featuregated-crd-manifests/machineconfigurations.operator.openshift.io/AAA_ungated.yaml b/operator/v1/zz_generated.featuregated-crd-manifests/machineconfigurations.operator.openshift.io/AAA_ungated.yaml index 4d8e6967942..740dbbbcc3c 100644 --- a/operator/v1/zz_generated.featuregated-crd-manifests/machineconfigurations.operator.openshift.io/AAA_ungated.yaml +++ b/operator/v1/zz_generated.featuregated-crd-manifests/machineconfigurations.operator.openshift.io/AAA_ungated.yaml @@ -46,6 +46,98 @@ spec: description: spec is the specification of the desired behavior of the Machine Config Operator properties: + bootImageSkewEnforcement: + description: |- + bootImageSkewEnforcement allows an admin to configure how boot image version skew is + enforced on the cluster. + When omitted, this will default to Automatic for clusters that support automatic boot image updates. + For clusters that do not support automatic boot image updates, cluster upgrades will be disabled until + a skew enforcement mode has been specified. + When version skew is being enforced, cluster upgrades will be disabled until the version skew is deemed + acceptable for the current release payload. + properties: + manual: + description: |- + manual describes the current boot image of the cluster. + This should be set to the oldest boot image used amongst all machine resources in the cluster. + This must include either the RHCOS version of the boot image or the OCP release version which shipped with that + RHCOS boot image. + Required when mode is set to "Manual" and forbidden otherwise. + properties: + mode: + description: |- + mode is used to configure which boot image field is defined in Manual mode. + Valid values are OCPVersion and RHCOSVersion. + OCPVersion means that the cluster admin is expected to set the OCP version associated with the last boot image update + in the OCPVersion field. + RHCOSVersion means that the cluster admin is expected to set the RHCOS version associated with the last boot image update + in the RHCOSVersion field. + This field is required. + enum: + - OCPVersion + - RHCOSVersion + type: string + ocpVersion: + description: |- + ocpVersion provides a string which represents the OCP version of the boot image. + This field must match the OCP semver compatible format of x.y.z. This field must be between + 5 and 10 characters long. + Required when mode is set to "OCPVersion" and forbidden otherwise. + maxLength: 10 + minLength: 5 + type: string + x-kubernetes-validations: + - message: ocpVersion must match the OCP semver compatible + format of x.y.z + rule: self.matches('^[0-9]+\\.[0-9]+\\.[0-9]+$') + rhcosVersion: + description: |- + rhcosVersion provides a string which represents the RHCOS version of the boot image + This field must match rhcosVersion formatting of [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] or the legacy + format of [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]. This field must be between + 14 and 21 characters long. + Required when mode is set to "RHCOSVersion" and forbidden otherwise. + maxLength: 21 + minLength: 14 + type: string + x-kubernetes-validations: + - message: rhcosVersion must match format [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] + or must match legacy format [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber] + rule: self.matches('^[0-9]+\\.[0-9]+\\.([0-9]{8}|[0-9]{12})-[0-9]+$') + required: + - mode + type: object + x-kubernetes-validations: + - message: ocpVersion is required when mode is OCPVersion, and + forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''OCPVersion'') ? has(self.ocpVersion) + : !has(self.ocpVersion)' + - message: rhcosVersion is required when mode is RHCOSVersion, + and forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''RHCOSVersion'') ? has(self.rhcosVersion) + : !has(self.rhcosVersion)' + mode: + description: |- + mode determines the underlying behavior of skew enforcement mechanism. + Valid values are Manual and None. + Manual means that the cluster admin is expected to perform manual boot image updates and store the OCP + & RHCOS version associated with the last boot image update in the manual field. + In Manual mode, the MCO will prevent upgrades when the boot image skew exceeds the + skew limit described by the release image. + None means that the MCO will no longer monitor the boot image skew. This may affect + the cluster's ability to scale. + This field is required. + enum: + - Manual + - None + type: string + required: + - mode + type: object + x-kubernetes-validations: + - message: manual is required when mode is Manual, and forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''Manual'') ? has(self.manual) + : !has(self.manual)' failedRevisionLimit: description: |- failedRevisionLimit is the number of failed static pod installer revisions to keep on disk and in the api @@ -653,6 +745,140 @@ spec: description: status is the most recently observed status of the Machine Config Operator properties: + bootImageSkewEnforcementStatus: + description: |- + bootImageSkewEnforcementStatus reflects what the latest cluster-validated boot image skew enforcement + configuration is and will be used by Machine Config Controller while performing boot image skew enforcement. + When omitted, the MCO has no knowledge of how to enforce boot image skew. When the MCO does not know how + boot image skew should be enforced, cluster upgrades will be blocked until it can either automatically + determine skew enforcement or there is an explicit skew enforcement configuration provided in the + spec.bootImageSkewEnforcement field. + properties: + automatic: + description: |- + automatic describes the current boot image of the cluster. + This will be populated by the MCO when performing boot image updates. This value will be compared against + the cluster's skew limit to determine skew compliance. + Required when mode is set to "Automatic" and forbidden otherwise. + minProperties: 1 + properties: + ocpVersion: + description: |- + ocpVersion provides a string which represents the OCP version of the boot image. + This field must match the OCP semver compatible format of x.y.z. This field must be between + 5 and 10 characters long. + maxLength: 10 + minLength: 5 + type: string + x-kubernetes-validations: + - message: ocpVersion must match the OCP semver compatible + format of x.y.z + rule: self.matches('^[0-9]+\\.[0-9]+\\.[0-9]+$') + rhcosVersion: + description: |- + rhcosVersion provides a string which represents the RHCOS version of the boot image + This field must match rhcosVersion formatting of [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] or the legacy + format of [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]. This field must be between + 14 and 21 characters long. + maxLength: 21 + minLength: 14 + type: string + x-kubernetes-validations: + - message: rhcosVersion must match format [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] + or must match legacy format [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber] + rule: self.matches('^[0-9]+\\.[0-9]+\\.([0-9]{8}|[0-9]{12})-[0-9]+$') + type: object + x-kubernetes-validations: + - message: at least one of ocpVersion or rhcosVersion is required + rule: has(self.ocpVersion) || has(self.rhcosVersion) + manual: + description: |- + manual describes the current boot image of the cluster. + This will be populated by the MCO using the values provided in the spec.bootImageSkewEnforcement.manual field. + This value will be compared against the cluster's skew limit to determine skew compliance. + Required when mode is set to "Manual" and forbidden otherwise. + properties: + mode: + description: |- + mode is used to configure which boot image field is defined in Manual mode. + Valid values are OCPVersion and RHCOSVersion. + OCPVersion means that the cluster admin is expected to set the OCP version associated with the last boot image update + in the OCPVersion field. + RHCOSVersion means that the cluster admin is expected to set the RHCOS version associated with the last boot image update + in the RHCOSVersion field. + This field is required. + enum: + - OCPVersion + - RHCOSVersion + type: string + ocpVersion: + description: |- + ocpVersion provides a string which represents the OCP version of the boot image. + This field must match the OCP semver compatible format of x.y.z. This field must be between + 5 and 10 characters long. + Required when mode is set to "OCPVersion" and forbidden otherwise. + maxLength: 10 + minLength: 5 + type: string + x-kubernetes-validations: + - message: ocpVersion must match the OCP semver compatible + format of x.y.z + rule: self.matches('^[0-9]+\\.[0-9]+\\.[0-9]+$') + rhcosVersion: + description: |- + rhcosVersion provides a string which represents the RHCOS version of the boot image + This field must match rhcosVersion formatting of [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] or the legacy + format of [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]. This field must be between + 14 and 21 characters long. + Required when mode is set to "RHCOSVersion" and forbidden otherwise. + maxLength: 21 + minLength: 14 + type: string + x-kubernetes-validations: + - message: rhcosVersion must match format [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] + or must match legacy format [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber] + rule: self.matches('^[0-9]+\\.[0-9]+\\.([0-9]{8}|[0-9]{12})-[0-9]+$') + required: + - mode + type: object + x-kubernetes-validations: + - message: ocpVersion is required when mode is OCPVersion, and + forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''OCPVersion'') ? has(self.ocpVersion) + : !has(self.ocpVersion)' + - message: rhcosVersion is required when mode is RHCOSVersion, + and forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''RHCOSVersion'') ? has(self.rhcosVersion) + : !has(self.rhcosVersion)' + mode: + description: |- + mode determines the underlying behavior of skew enforcement mechanism. + Valid values are Automatic, Manual and None. + Automatic means that the MCO will perform boot image updates and store the + OCP & RHCOS version associated with the last boot image update in the automatic field. + Manual means that the cluster admin is expected to perform manual boot image updates and store the OCP + & RHCOS version associated with the last boot image update in the manual field. + In Automatic and Manual mode, the MCO will prevent upgrades when the boot image skew exceeds the + skew limit described by the release image. + None means that the MCO will no longer monitor the boot image skew. This may affect + the cluster's ability to scale. + This field is required. + enum: + - Automatic + - Manual + - None + type: string + required: + - mode + type: object + x-kubernetes-validations: + - message: automatic is required when mode is Automatic, and forbidden + otherwise + rule: 'has(self.mode) && (self.mode == ''Automatic'') ? has(self.automatic) + : !has(self.automatic)' + - message: manual is required when mode is Manual, and forbidden otherwise + rule: 'has(self.mode) && (self.mode == ''Manual'') ? has(self.manual) + : !has(self.manual)' conditions: description: conditions is a list of conditions and their status items: @@ -1251,6 +1477,32 @@ spec: required: - spec type: object + x-kubernetes-validations: + - message: when skew enforcement is in Automatic mode, a boot image configuration + is required + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? self.?spec.managedBootImages.hasValue() || self.?status.managedBootImagesStatus.hasValue() + : true' + - message: when skew enforcement is in Automatic mode, managedBootImages.machineManagers + must not be an empty list + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || size(self.spec.managedBootImages.machineManagers) + > 0 : true' + - message: when skew enforcement is in Automatic mode, any MachineAPI MachineSet + MachineManager must use selection mode 'All' + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || !self.spec.managedBootImages.machineManagers.exists(m, + m.resource == ''machinesets'' && m.apiGroup == ''machine.openshift.io'') + || self.spec.managedBootImages.machineManagers.exists(m, m.resource == + ''machinesets'' && m.apiGroup == ''machine.openshift.io'' && m.selection.mode + == ''All'') : true' + - message: when skew enforcement is in Automatic mode, managedBootImagesStatus + must contain a MachineManager opting in all MachineAPI MachineSets + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? !(self.?status.managedBootImagesStatus.machineManagers.hasValue()) || + self.status.managedBootImagesStatus.machineManagers.exists(m, m.selection.mode + == ''All'' && m.resource == ''machinesets'' && m.apiGroup == ''machine.openshift.io''): + true' served: true storage: true subresources: diff --git a/operator/v1/zz_generated.featuregated-crd-manifests/machineconfigurations.operator.openshift.io/BootImageSkewEnforcement.yaml b/operator/v1/zz_generated.featuregated-crd-manifests/machineconfigurations.operator.openshift.io/BootImageSkewEnforcement.yaml deleted file mode 100644 index ba32e239c5d..00000000000 --- a/operator/v1/zz_generated.featuregated-crd-manifests/machineconfigurations.operator.openshift.io/BootImageSkewEnforcement.yaml +++ /dev/null @@ -1,1501 +0,0 @@ -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - api-approved.openshift.io: https://github.com/openshift/api/pull/1453 - api.openshift.io/filename-cvo-runlevel: "0000_80" - api.openshift.io/filename-operator: machine-config - api.openshift.io/filename-ordering: "01" - feature-gate.release.openshift.io/BootImageSkewEnforcement: "true" - name: machineconfigurations.operator.openshift.io -spec: - group: operator.openshift.io - names: - kind: MachineConfiguration - listKind: MachineConfigurationList - plural: machineconfigurations - singular: machineconfiguration - scope: Cluster - versions: - - name: v1 - schema: - openAPIV3Schema: - description: |- - MachineConfiguration provides information to configure an operator to manage Machine Configuration. - - Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: spec is the specification of the desired behavior of the - Machine Config Operator - properties: - bootImageSkewEnforcement: - description: |- - bootImageSkewEnforcement allows an admin to configure how boot image version skew is - enforced on the cluster. - When omitted, this will default to Automatic for clusters that support automatic boot image updates. - For clusters that do not support automatic boot image updates, cluster upgrades will be disabled until - a skew enforcement mode has been specified. - When version skew is being enforced, cluster upgrades will be disabled until the version skew is deemed - acceptable for the current release payload. - properties: - manual: - description: |- - manual describes the current boot image of the cluster. - This should be set to the oldest boot image used amongst all machine resources in the cluster. - This must include either the RHCOS version of the boot image or the OCP release version which shipped with that - RHCOS boot image. - Required when mode is set to "Manual" and forbidden otherwise. - properties: - mode: - description: |- - mode is used to configure which boot image field is defined in Manual mode. - Valid values are OCPVersion and RHCOSVersion. - OCPVersion means that the cluster admin is expected to set the OCP version associated with the last boot image update - in the OCPVersion field. - RHCOSVersion means that the cluster admin is expected to set the RHCOS version associated with the last boot image update - in the RHCOSVersion field. - This field is required. - enum: - - OCPVersion - - RHCOSVersion - type: string - ocpVersion: - description: |- - ocpVersion provides a string which represents the OCP version of the boot image. - This field must match the OCP semver compatible format of x.y.z. This field must be between - 5 and 10 characters long. - Required when mode is set to "OCPVersion" and forbidden otherwise. - maxLength: 10 - minLength: 5 - type: string - x-kubernetes-validations: - - message: ocpVersion must match the OCP semver compatible - format of x.y.z - rule: self.matches('^[0-9]+\\.[0-9]+\\.[0-9]+$') - rhcosVersion: - description: |- - rhcosVersion provides a string which represents the RHCOS version of the boot image - This field must match rhcosVersion formatting of [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] or the legacy - format of [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]. This field must be between - 14 and 21 characters long. - Required when mode is set to "RHCOSVersion" and forbidden otherwise. - maxLength: 21 - minLength: 14 - type: string - x-kubernetes-validations: - - message: rhcosVersion must match format [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] - or must match legacy format [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber] - rule: self.matches('^[0-9]+\\.[0-9]+\\.([0-9]{8}|[0-9]{12})-[0-9]+$') - required: - - mode - type: object - x-kubernetes-validations: - - message: ocpVersion is required when mode is OCPVersion, and - forbidden otherwise - rule: 'has(self.mode) && (self.mode ==''OCPVersion'') ? has(self.ocpVersion) - : !has(self.ocpVersion)' - - message: rhcosVersion is required when mode is RHCOSVersion, - and forbidden otherwise - rule: 'has(self.mode) && (self.mode ==''RHCOSVersion'') ? has(self.rhcosVersion) - : !has(self.rhcosVersion)' - mode: - description: |- - mode determines the underlying behavior of skew enforcement mechanism. - Valid values are Manual and None. - Manual means that the cluster admin is expected to perform manual boot image updates and store the OCP - & RHCOS version associated with the last boot image update in the manual field. - In Manual mode, the MCO will prevent upgrades when the boot image skew exceeds the - skew limit described by the release image. - None means that the MCO will no longer monitor the boot image skew. This may affect - the cluster's ability to scale. - This field is required. - enum: - - Manual - - None - type: string - required: - - mode - type: object - x-kubernetes-validations: - - message: manual is required when mode is Manual, and forbidden otherwise - rule: 'has(self.mode) && (self.mode ==''Manual'') ? has(self.manual) - : !has(self.manual)' - failedRevisionLimit: - description: |- - failedRevisionLimit is the number of failed static pod installer revisions to keep on disk and in the api - -1 = unlimited, 0 or unset = 5 (default) - format: int32 - type: integer - forceRedeploymentReason: - description: |- - forceRedeploymentReason can be used to force the redeployment of the operand by providing a unique string. - This provides a mechanism to kick a previously failed deployment and provide a reason why you think it will work - this time instead of failing again on the same config. - type: string - logLevel: - default: Normal - description: |- - logLevel is an intent based logging for an overall component. It does not give fine grained control, but it is a - simple way to manage coarse grained logging choices that operators have to interpret for their operands. - - Valid values are: "Normal", "Debug", "Trace", "TraceAll". - Defaults to "Normal". - enum: - - "" - - Normal - - Debug - - Trace - - TraceAll - type: string - managedBootImages: - description: |- - managedBootImages allows configuration for the management of boot images for machine - resources within the cluster. This configuration allows users to select resources that should - be updated to the latest boot images during cluster upgrades, ensuring that new machines - always boot with the current cluster version's boot image. When omitted, this means no opinion - and the platform is left to choose a reasonable default, which is subject to change over time. - The default for each machine manager mode is All for GCP and AWS platforms, and None for all - other platforms. - properties: - machineManagers: - description: |- - machineManagers can be used to register machine management resources for boot image updates. The Machine Config Operator - will watch for changes to this list. Only one entry is permitted per type of machine management resource. - items: - description: |- - MachineManager describes a target machine resource that is registered for boot image updates. It stores identifying information - such as the resource type and the API Group of the resource. It also provides granular control via the selection field. - properties: - apiGroup: - description: |- - apiGroup is name of the APIGroup that the machine management resource belongs to. - Valid values are machine.openshift.io and cluster.x-k8s.io. - machine.openshift.io means that the machine manager will only register resources that belong to OpenShift machine API group. - cluster.x-k8s.io means that the machine manager will only register resources that belong to the Cluster API group. - type: string - resource: - description: |- - resource is the machine management resource's type. - Valid values are machinesets, controlplanemachinesets and machinedeployments. - machinesets means that the machine manager will only register resources of the kind MachineSet. - controlplanemachinesets means that the machine manager will only register resources of the kind ControlPlaneMachineSet. - machinedeployments means that the machine manager will only register resources of the kind MachineDeployment. - type: string - selection: - description: selection allows granular control of the machine - management resources that will be registered for boot - image updates. - properties: - mode: - description: |- - mode determines how machine managers will be selected for updates. - Valid values are All, Partial and None. - All means that every resource matched by the machine manager will be updated. - Partial requires specified selector(s) and allows customisation of which resources matched by the machine manager will be updated. - Partial is not permitted for the controlplanemachinesets resource type as they are a singleton within the cluster. - None means that every resource matched by the machine manager will not be updated. - enum: - - All - - Partial - - None - type: string - partial: - description: |- - partial provides label selector(s) that can be used to match machine management resources. - Only permitted when mode is set to "Partial". - properties: - machineResourceSelector: - description: machineResourceSelector is a label - selector that can be used to select machine resources - like MachineSets. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - required: - - machineResourceSelector - type: object - required: - - mode - type: object - x-kubernetes-validations: - - message: Partial is required when type is partial, and - forbidden otherwise - rule: 'has(self.mode) && self.mode == ''Partial'' ? has(self.partial) - : !has(self.partial)' - required: - - apiGroup - - resource - - selection - type: object - maxItems: 5 - type: array - x-kubernetes-list-map-keys: - - resource - - apiGroup - x-kubernetes-list-type: map - type: object - managementState: - description: managementState indicates whether and how the operator - should manage the component - pattern: ^(Managed|Unmanaged|Force|Removed)$ - type: string - nodeDisruptionPolicy: - description: |- - nodeDisruptionPolicy allows an admin to set granular node disruption actions for - MachineConfig-based updates, such as drains, service reloads, etc. Specifying this will allow - for less downtime when doing small configuration updates to the cluster. This configuration - has no effect on cluster upgrades which will still incur node disruption where required. - properties: - files: - description: |- - files is a list of MachineConfig file definitions and actions to take to changes on those paths - This list supports a maximum of 50 entries. - items: - description: NodeDisruptionPolicySpecFile is a file entry and - corresponding actions to take and is used in the NodeDisruptionPolicyConfig - object - properties: - actions: - description: |- - actions represents the series of commands to be executed on changes to the file at - the corresponding file path. Actions will be applied in the order that - they are set in this list. If there are other incoming changes to other MachineConfig - entries in the same update that require a reboot, the reboot will supersede these actions. - Valid actions are Reboot, Drain, Reload, DaemonReload and None. - The Reboot action and the None action cannot be used in conjunction with any of the other actions. - This list supports a maximum of 10 entries. - items: - properties: - reload: - description: reload specifies the service to reload, - only valid if type is reload - properties: - serviceName: - description: |- - serviceName is the full name (e.g. crio.service) of the service to be reloaded - Service names should be of the format ${NAME}${SERVICETYPE} and can up to 255 characters long. - ${NAME} must be atleast 1 character long and can only consist of alphabets, digits, ":", "-", "_", ".", and "\". - ${SERVICETYPE} must be one of ".service", ".socket", ".device", ".mount", ".automount", ".swap", ".target", ".path", ".timer", ".snapshot", ".slice" or ".scope". - maxLength: 255 - type: string - x-kubernetes-validations: - - message: Invalid ${SERVICETYPE} in service name. - Expected format is ${NAME}${SERVICETYPE}, - where ${SERVICETYPE} must be one of ".service", - ".socket", ".device", ".mount", ".automount", - ".swap", ".target", ".path", ".timer",".snapshot", - ".slice" or ".scope". - rule: self.matches('\\.(service|socket|device|mount|automount|swap|target|path|timer|snapshot|slice|scope)$') - - message: Invalid ${NAME} in service name. Expected - format is ${NAME}${SERVICETYPE}, where {NAME} - must be atleast 1 character long and can only - consist of alphabets, digits, ":", "-", "_", - ".", and "\" - rule: self.matches('^[a-zA-Z0-9:._\\\\-]+\\..') - required: - - serviceName - type: object - restart: - description: restart specifies the service to restart, - only valid if type is restart - properties: - serviceName: - description: |- - serviceName is the full name (e.g. crio.service) of the service to be restarted - Service names should be of the format ${NAME}${SERVICETYPE} and can up to 255 characters long. - ${NAME} must be atleast 1 character long and can only consist of alphabets, digits, ":", "-", "_", ".", and "\". - ${SERVICETYPE} must be one of ".service", ".socket", ".device", ".mount", ".automount", ".swap", ".target", ".path", ".timer", ".snapshot", ".slice" or ".scope". - maxLength: 255 - type: string - x-kubernetes-validations: - - message: Invalid ${SERVICETYPE} in service name. - Expected format is ${NAME}${SERVICETYPE}, - where ${SERVICETYPE} must be one of ".service", - ".socket", ".device", ".mount", ".automount", - ".swap", ".target", ".path", ".timer",".snapshot", - ".slice" or ".scope". - rule: self.matches('\\.(service|socket|device|mount|automount|swap|target|path|timer|snapshot|slice|scope)$') - - message: Invalid ${NAME} in service name. Expected - format is ${NAME}${SERVICETYPE}, where {NAME} - must be atleast 1 character long and can only - consist of alphabets, digits, ":", "-", "_", - ".", and "\" - rule: self.matches('^[a-zA-Z0-9:._\\\\-]+\\..') - required: - - serviceName - type: object - type: - description: |- - type represents the commands that will be carried out if this NodeDisruptionPolicySpecActionType is executed - Valid values are Reboot, Drain, Reload, Restart, DaemonReload and None. - reload/restart requires a corresponding service target specified in the reload/restart field. - Other values require no further configuration - enum: - - Reboot - - Drain - - Reload - - Restart - - DaemonReload - - None - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: reload is required when type is Reload, and - forbidden otherwise - rule: 'has(self.type) && self.type == ''Reload'' ? has(self.reload) - : !has(self.reload)' - - message: restart is required when type is Restart, and - forbidden otherwise - rule: 'has(self.type) && self.type == ''Restart'' ? - has(self.restart) : !has(self.restart)' - maxItems: 10 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - message: Reboot action can only be specified standalone, - as it will override any other actions - rule: 'self.exists(x, x.type==''Reboot'') ? size(self) - == 1 : true' - - message: None action can only be specified standalone, - as it will override any other actions - rule: 'self.exists(x, x.type==''None'') ? size(self) == - 1 : true' - path: - description: |- - path is the location of a file being managed through a MachineConfig. - The Actions in the policy will apply to changes to the file at this path. - type: string - required: - - actions - - path - type: object - maxItems: 50 - type: array - x-kubernetes-list-map-keys: - - path - x-kubernetes-list-type: map - sshkey: - description: |- - sshkey maps to the ignition.sshkeys field in the MachineConfig object, definition an action for this - will apply to all sshkey changes in the cluster - properties: - actions: - description: |- - actions represents the series of commands to be executed on changes to the file at - the corresponding file path. Actions will be applied in the order that - they are set in this list. If there are other incoming changes to other MachineConfig - entries in the same update that require a reboot, the reboot will supersede these actions. - Valid actions are Reboot, Drain, Reload, DaemonReload and None. - The Reboot action and the None action cannot be used in conjunction with any of the other actions. - This list supports a maximum of 10 entries. - items: - properties: - reload: - description: reload specifies the service to reload, - only valid if type is reload - properties: - serviceName: - description: |- - serviceName is the full name (e.g. crio.service) of the service to be reloaded - Service names should be of the format ${NAME}${SERVICETYPE} and can up to 255 characters long. - ${NAME} must be atleast 1 character long and can only consist of alphabets, digits, ":", "-", "_", ".", and "\". - ${SERVICETYPE} must be one of ".service", ".socket", ".device", ".mount", ".automount", ".swap", ".target", ".path", ".timer", ".snapshot", ".slice" or ".scope". - maxLength: 255 - type: string - x-kubernetes-validations: - - message: Invalid ${SERVICETYPE} in service name. - Expected format is ${NAME}${SERVICETYPE}, where - ${SERVICETYPE} must be one of ".service", ".socket", - ".device", ".mount", ".automount", ".swap", - ".target", ".path", ".timer",".snapshot", ".slice" - or ".scope". - rule: self.matches('\\.(service|socket|device|mount|automount|swap|target|path|timer|snapshot|slice|scope)$') - - message: Invalid ${NAME} in service name. Expected - format is ${NAME}${SERVICETYPE}, where {NAME} - must be atleast 1 character long and can only - consist of alphabets, digits, ":", "-", "_", - ".", and "\" - rule: self.matches('^[a-zA-Z0-9:._\\\\-]+\\..') - required: - - serviceName - type: object - restart: - description: restart specifies the service to restart, - only valid if type is restart - properties: - serviceName: - description: |- - serviceName is the full name (e.g. crio.service) of the service to be restarted - Service names should be of the format ${NAME}${SERVICETYPE} and can up to 255 characters long. - ${NAME} must be atleast 1 character long and can only consist of alphabets, digits, ":", "-", "_", ".", and "\". - ${SERVICETYPE} must be one of ".service", ".socket", ".device", ".mount", ".automount", ".swap", ".target", ".path", ".timer", ".snapshot", ".slice" or ".scope". - maxLength: 255 - type: string - x-kubernetes-validations: - - message: Invalid ${SERVICETYPE} in service name. - Expected format is ${NAME}${SERVICETYPE}, where - ${SERVICETYPE} must be one of ".service", ".socket", - ".device", ".mount", ".automount", ".swap", - ".target", ".path", ".timer",".snapshot", ".slice" - or ".scope". - rule: self.matches('\\.(service|socket|device|mount|automount|swap|target|path|timer|snapshot|slice|scope)$') - - message: Invalid ${NAME} in service name. Expected - format is ${NAME}${SERVICETYPE}, where {NAME} - must be atleast 1 character long and can only - consist of alphabets, digits, ":", "-", "_", - ".", and "\" - rule: self.matches('^[a-zA-Z0-9:._\\\\-]+\\..') - required: - - serviceName - type: object - type: - description: |- - type represents the commands that will be carried out if this NodeDisruptionPolicySpecActionType is executed - Valid values are Reboot, Drain, Reload, Restart, DaemonReload and None. - reload/restart requires a corresponding service target specified in the reload/restart field. - Other values require no further configuration - enum: - - Reboot - - Drain - - Reload - - Restart - - DaemonReload - - None - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: reload is required when type is Reload, and forbidden - otherwise - rule: 'has(self.type) && self.type == ''Reload'' ? has(self.reload) - : !has(self.reload)' - - message: restart is required when type is Restart, and - forbidden otherwise - rule: 'has(self.type) && self.type == ''Restart'' ? has(self.restart) - : !has(self.restart)' - maxItems: 10 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - message: Reboot action can only be specified standalone, - as it will override any other actions - rule: 'self.exists(x, x.type==''Reboot'') ? size(self) == - 1 : true' - - message: None action can only be specified standalone, as - it will override any other actions - rule: 'self.exists(x, x.type==''None'') ? size(self) == - 1 : true' - required: - - actions - type: object - units: - description: |- - units is a list MachineConfig unit definitions and actions to take on changes to those services - This list supports a maximum of 50 entries. - items: - description: NodeDisruptionPolicySpecUnit is a systemd unit - name and corresponding actions to take and is used in the - NodeDisruptionPolicyConfig object - properties: - actions: - description: |- - actions represents the series of commands to be executed on changes to the file at - the corresponding file path. Actions will be applied in the order that - they are set in this list. If there are other incoming changes to other MachineConfig - entries in the same update that require a reboot, the reboot will supersede these actions. - Valid actions are Reboot, Drain, Reload, DaemonReload and None. - The Reboot action and the None action cannot be used in conjunction with any of the other actions. - This list supports a maximum of 10 entries. - items: - properties: - reload: - description: reload specifies the service to reload, - only valid if type is reload - properties: - serviceName: - description: |- - serviceName is the full name (e.g. crio.service) of the service to be reloaded - Service names should be of the format ${NAME}${SERVICETYPE} and can up to 255 characters long. - ${NAME} must be atleast 1 character long and can only consist of alphabets, digits, ":", "-", "_", ".", and "\". - ${SERVICETYPE} must be one of ".service", ".socket", ".device", ".mount", ".automount", ".swap", ".target", ".path", ".timer", ".snapshot", ".slice" or ".scope". - maxLength: 255 - type: string - x-kubernetes-validations: - - message: Invalid ${SERVICETYPE} in service name. - Expected format is ${NAME}${SERVICETYPE}, - where ${SERVICETYPE} must be one of ".service", - ".socket", ".device", ".mount", ".automount", - ".swap", ".target", ".path", ".timer",".snapshot", - ".slice" or ".scope". - rule: self.matches('\\.(service|socket|device|mount|automount|swap|target|path|timer|snapshot|slice|scope)$') - - message: Invalid ${NAME} in service name. Expected - format is ${NAME}${SERVICETYPE}, where {NAME} - must be atleast 1 character long and can only - consist of alphabets, digits, ":", "-", "_", - ".", and "\" - rule: self.matches('^[a-zA-Z0-9:._\\\\-]+\\..') - required: - - serviceName - type: object - restart: - description: restart specifies the service to restart, - only valid if type is restart - properties: - serviceName: - description: |- - serviceName is the full name (e.g. crio.service) of the service to be restarted - Service names should be of the format ${NAME}${SERVICETYPE} and can up to 255 characters long. - ${NAME} must be atleast 1 character long and can only consist of alphabets, digits, ":", "-", "_", ".", and "\". - ${SERVICETYPE} must be one of ".service", ".socket", ".device", ".mount", ".automount", ".swap", ".target", ".path", ".timer", ".snapshot", ".slice" or ".scope". - maxLength: 255 - type: string - x-kubernetes-validations: - - message: Invalid ${SERVICETYPE} in service name. - Expected format is ${NAME}${SERVICETYPE}, - where ${SERVICETYPE} must be one of ".service", - ".socket", ".device", ".mount", ".automount", - ".swap", ".target", ".path", ".timer",".snapshot", - ".slice" or ".scope". - rule: self.matches('\\.(service|socket|device|mount|automount|swap|target|path|timer|snapshot|slice|scope)$') - - message: Invalid ${NAME} in service name. Expected - format is ${NAME}${SERVICETYPE}, where {NAME} - must be atleast 1 character long and can only - consist of alphabets, digits, ":", "-", "_", - ".", and "\" - rule: self.matches('^[a-zA-Z0-9:._\\\\-]+\\..') - required: - - serviceName - type: object - type: - description: |- - type represents the commands that will be carried out if this NodeDisruptionPolicySpecActionType is executed - Valid values are Reboot, Drain, Reload, Restart, DaemonReload and None. - reload/restart requires a corresponding service target specified in the reload/restart field. - Other values require no further configuration - enum: - - Reboot - - Drain - - Reload - - Restart - - DaemonReload - - None - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: reload is required when type is Reload, and - forbidden otherwise - rule: 'has(self.type) && self.type == ''Reload'' ? has(self.reload) - : !has(self.reload)' - - message: restart is required when type is Restart, and - forbidden otherwise - rule: 'has(self.type) && self.type == ''Restart'' ? - has(self.restart) : !has(self.restart)' - maxItems: 10 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - message: Reboot action can only be specified standalone, - as it will override any other actions - rule: 'self.exists(x, x.type==''Reboot'') ? size(self) - == 1 : true' - - message: None action can only be specified standalone, - as it will override any other actions - rule: 'self.exists(x, x.type==''None'') ? size(self) == - 1 : true' - name: - description: |- - name represents the service name of a systemd service managed through a MachineConfig - Actions specified will be applied for changes to the named service. - Service names should be of the format ${NAME}${SERVICETYPE} and can up to 255 characters long. - ${NAME} must be atleast 1 character long and can only consist of alphabets, digits, ":", "-", "_", ".", and "\". - ${SERVICETYPE} must be one of ".service", ".socket", ".device", ".mount", ".automount", ".swap", ".target", ".path", ".timer", ".snapshot", ".slice" or ".scope". - maxLength: 255 - type: string - x-kubernetes-validations: - - message: Invalid ${SERVICETYPE} in service name. Expected - format is ${NAME}${SERVICETYPE}, where ${SERVICETYPE} - must be one of ".service", ".socket", ".device", ".mount", - ".automount", ".swap", ".target", ".path", ".timer",".snapshot", - ".slice" or ".scope". - rule: self.matches('\\.(service|socket|device|mount|automount|swap|target|path|timer|snapshot|slice|scope)$') - - message: Invalid ${NAME} in service name. Expected format - is ${NAME}${SERVICETYPE}, where {NAME} must be atleast - 1 character long and can only consist of alphabets, - digits, ":", "-", "_", ".", and "\" - rule: self.matches('^[a-zA-Z0-9:._\\\\-]+\\..') - required: - - actions - - name - type: object - maxItems: 50 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - observedConfig: - description: |- - observedConfig holds a sparse config that controller has observed from the cluster state. It exists in spec because - it is an input to the level for the operator - nullable: true - type: object - x-kubernetes-preserve-unknown-fields: true - operatorLogLevel: - default: Normal - description: |- - operatorLogLevel is an intent based logging for the operator itself. It does not give fine grained control, but it is a - simple way to manage coarse grained logging choices that operators have to interpret for themselves. - - Valid values are: "Normal", "Debug", "Trace", "TraceAll". - Defaults to "Normal". - enum: - - "" - - Normal - - Debug - - Trace - - TraceAll - type: string - succeededRevisionLimit: - description: |- - succeededRevisionLimit is the number of successful static pod installer revisions to keep on disk and in the api - -1 = unlimited, 0 or unset = 5 (default) - format: int32 - type: integer - unsupportedConfigOverrides: - description: |- - unsupportedConfigOverrides overrides the final configuration that was computed by the operator. - Red Hat does not support the use of this field. - Misuse of this field could lead to unexpected behavior or conflict with other configuration options. - Seek guidance from the Red Hat support before using this field. - Use of this property blocks cluster upgrades, it must be removed before upgrading your cluster. - nullable: true - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - status: - description: status is the most recently observed status of the Machine - Config Operator - properties: - bootImageSkewEnforcementStatus: - description: |- - bootImageSkewEnforcementStatus reflects what the latest cluster-validated boot image skew enforcement - configuration is and will be used by Machine Config Controller while performing boot image skew enforcement. - When omitted, the MCO has no knowledge of how to enforce boot image skew. When the MCO does not know how - boot image skew should be enforced, cluster upgrades will be blocked until it can either automatically - determine skew enforcement or there is an explicit skew enforcement configuration provided in the - spec.bootImageSkewEnforcement field. - properties: - automatic: - description: |- - automatic describes the current boot image of the cluster. - This will be populated by the MCO when performing boot image updates. This value will be compared against - the cluster's skew limit to determine skew compliance. - Required when mode is set to "Automatic" and forbidden otherwise. - minProperties: 1 - properties: - ocpVersion: - description: |- - ocpVersion provides a string which represents the OCP version of the boot image. - This field must match the OCP semver compatible format of x.y.z. This field must be between - 5 and 10 characters long. - maxLength: 10 - minLength: 5 - type: string - x-kubernetes-validations: - - message: ocpVersion must match the OCP semver compatible - format of x.y.z - rule: self.matches('^[0-9]+\\.[0-9]+\\.[0-9]+$') - rhcosVersion: - description: |- - rhcosVersion provides a string which represents the RHCOS version of the boot image - This field must match rhcosVersion formatting of [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] or the legacy - format of [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]. This field must be between - 14 and 21 characters long. - maxLength: 21 - minLength: 14 - type: string - x-kubernetes-validations: - - message: rhcosVersion must match format [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] - or must match legacy format [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber] - rule: self.matches('^[0-9]+\\.[0-9]+\\.([0-9]{8}|[0-9]{12})-[0-9]+$') - type: object - x-kubernetes-validations: - - message: at least one of ocpVersion or rhcosVersion is required - rule: has(self.ocpVersion) || has(self.rhcosVersion) - manual: - description: |- - manual describes the current boot image of the cluster. - This will be populated by the MCO using the values provided in the spec.bootImageSkewEnforcement.manual field. - This value will be compared against the cluster's skew limit to determine skew compliance. - Required when mode is set to "Manual" and forbidden otherwise. - properties: - mode: - description: |- - mode is used to configure which boot image field is defined in Manual mode. - Valid values are OCPVersion and RHCOSVersion. - OCPVersion means that the cluster admin is expected to set the OCP version associated with the last boot image update - in the OCPVersion field. - RHCOSVersion means that the cluster admin is expected to set the RHCOS version associated with the last boot image update - in the RHCOSVersion field. - This field is required. - enum: - - OCPVersion - - RHCOSVersion - type: string - ocpVersion: - description: |- - ocpVersion provides a string which represents the OCP version of the boot image. - This field must match the OCP semver compatible format of x.y.z. This field must be between - 5 and 10 characters long. - Required when mode is set to "OCPVersion" and forbidden otherwise. - maxLength: 10 - minLength: 5 - type: string - x-kubernetes-validations: - - message: ocpVersion must match the OCP semver compatible - format of x.y.z - rule: self.matches('^[0-9]+\\.[0-9]+\\.[0-9]+$') - rhcosVersion: - description: |- - rhcosVersion provides a string which represents the RHCOS version of the boot image - This field must match rhcosVersion formatting of [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] or the legacy - format of [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]. This field must be between - 14 and 21 characters long. - Required when mode is set to "RHCOSVersion" and forbidden otherwise. - maxLength: 21 - minLength: 14 - type: string - x-kubernetes-validations: - - message: rhcosVersion must match format [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] - or must match legacy format [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber] - rule: self.matches('^[0-9]+\\.[0-9]+\\.([0-9]{8}|[0-9]{12})-[0-9]+$') - required: - - mode - type: object - x-kubernetes-validations: - - message: ocpVersion is required when mode is OCPVersion, and - forbidden otherwise - rule: 'has(self.mode) && (self.mode ==''OCPVersion'') ? has(self.ocpVersion) - : !has(self.ocpVersion)' - - message: rhcosVersion is required when mode is RHCOSVersion, - and forbidden otherwise - rule: 'has(self.mode) && (self.mode ==''RHCOSVersion'') ? has(self.rhcosVersion) - : !has(self.rhcosVersion)' - mode: - description: |- - mode determines the underlying behavior of skew enforcement mechanism. - Valid values are Automatic, Manual and None. - Automatic means that the MCO will perform boot image updates and store the - OCP & RHCOS version associated with the last boot image update in the automatic field. - Manual means that the cluster admin is expected to perform manual boot image updates and store the OCP - & RHCOS version associated with the last boot image update in the manual field. - In Automatic and Manual mode, the MCO will prevent upgrades when the boot image skew exceeds the - skew limit described by the release image. - None means that the MCO will no longer monitor the boot image skew. This may affect - the cluster's ability to scale. - This field is required. - enum: - - Automatic - - Manual - - None - type: string - required: - - mode - type: object - x-kubernetes-validations: - - message: automatic is required when mode is Automatic, and forbidden - otherwise - rule: 'has(self.mode) && (self.mode == ''Automatic'') ? has(self.automatic) - : !has(self.automatic)' - - message: manual is required when mode is Manual, and forbidden otherwise - rule: 'has(self.mode) && (self.mode == ''Manual'') ? has(self.manual) - : !has(self.manual)' - conditions: - description: conditions is a list of conditions and their status - items: - description: Condition contains details for one aspect of the current - state of this API Resource. - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - managedBootImagesStatus: - description: |- - managedBootImagesStatus reflects what the latest cluster-validated boot image configuration is - and will be used by Machine Config Controller while performing boot image updates. - properties: - machineManagers: - description: |- - machineManagers can be used to register machine management resources for boot image updates. The Machine Config Operator - will watch for changes to this list. Only one entry is permitted per type of machine management resource. - items: - description: |- - MachineManager describes a target machine resource that is registered for boot image updates. It stores identifying information - such as the resource type and the API Group of the resource. It also provides granular control via the selection field. - properties: - apiGroup: - description: |- - apiGroup is name of the APIGroup that the machine management resource belongs to. - Valid values are machine.openshift.io and cluster.x-k8s.io. - machine.openshift.io means that the machine manager will only register resources that belong to OpenShift machine API group. - cluster.x-k8s.io means that the machine manager will only register resources that belong to the Cluster API group. - type: string - resource: - description: |- - resource is the machine management resource's type. - Valid values are machinesets, controlplanemachinesets and machinedeployments. - machinesets means that the machine manager will only register resources of the kind MachineSet. - controlplanemachinesets means that the machine manager will only register resources of the kind ControlPlaneMachineSet. - machinedeployments means that the machine manager will only register resources of the kind MachineDeployment. - type: string - selection: - description: selection allows granular control of the machine - management resources that will be registered for boot - image updates. - properties: - mode: - description: |- - mode determines how machine managers will be selected for updates. - Valid values are All, Partial and None. - All means that every resource matched by the machine manager will be updated. - Partial requires specified selector(s) and allows customisation of which resources matched by the machine manager will be updated. - Partial is not permitted for the controlplanemachinesets resource type as they are a singleton within the cluster. - None means that every resource matched by the machine manager will not be updated. - enum: - - All - - Partial - - None - type: string - partial: - description: |- - partial provides label selector(s) that can be used to match machine management resources. - Only permitted when mode is set to "Partial". - properties: - machineResourceSelector: - description: machineResourceSelector is a label - selector that can be used to select machine resources - like MachineSets. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - required: - - machineResourceSelector - type: object - required: - - mode - type: object - x-kubernetes-validations: - - message: Partial is required when type is partial, and - forbidden otherwise - rule: 'has(self.mode) && self.mode == ''Partial'' ? has(self.partial) - : !has(self.partial)' - required: - - apiGroup - - resource - - selection - type: object - maxItems: 5 - type: array - x-kubernetes-list-map-keys: - - resource - - apiGroup - x-kubernetes-list-type: map - type: object - nodeDisruptionPolicyStatus: - description: |- - nodeDisruptionPolicyStatus status reflects what the latest cluster-validated policies are, - and will be used by the Machine Config Daemon during future node updates. - properties: - clusterPolicies: - description: clusterPolicies is a merge of cluster default and - user provided node disruption policies. - properties: - files: - description: files is a list of MachineConfig file definitions - and actions to take to changes on those paths - items: - description: NodeDisruptionPolicyStatusFile is a file entry - and corresponding actions to take and is used in the NodeDisruptionPolicyClusterStatus - object - properties: - actions: - description: |- - actions represents the series of commands to be executed on changes to the file at - the corresponding file path. Actions will be applied in the order that - they are set in this list. If there are other incoming changes to other MachineConfig - entries in the same update that require a reboot, the reboot will supersede these actions. - Valid actions are Reboot, Drain, Reload, DaemonReload and None. - The Reboot action and the None action cannot be used in conjunction with any of the other actions. - This list supports a maximum of 10 entries. - items: - properties: - reload: - description: reload specifies the service to reload, - only valid if type is reload - properties: - serviceName: - description: |- - serviceName is the full name (e.g. crio.service) of the service to be reloaded - Service names should be of the format ${NAME}${SERVICETYPE} and can up to 255 characters long. - ${NAME} must be atleast 1 character long and can only consist of alphabets, digits, ":", "-", "_", ".", and "\". - ${SERVICETYPE} must be one of ".service", ".socket", ".device", ".mount", ".automount", ".swap", ".target", ".path", ".timer", ".snapshot", ".slice" or ".scope". - maxLength: 255 - type: string - x-kubernetes-validations: - - message: Invalid ${SERVICETYPE} in service - name. Expected format is ${NAME}${SERVICETYPE}, - where ${SERVICETYPE} must be one of ".service", - ".socket", ".device", ".mount", ".automount", - ".swap", ".target", ".path", ".timer",".snapshot", - ".slice" or ".scope". - rule: self.matches('\\.(service|socket|device|mount|automount|swap|target|path|timer|snapshot|slice|scope)$') - - message: Invalid ${NAME} in service name. - Expected format is ${NAME}${SERVICETYPE}, - where {NAME} must be atleast 1 character - long and can only consist of alphabets, - digits, ":", "-", "_", ".", and "\" - rule: self.matches('^[a-zA-Z0-9:._\\\\-]+\\..') - required: - - serviceName - type: object - restart: - description: restart specifies the service to - restart, only valid if type is restart - properties: - serviceName: - description: |- - serviceName is the full name (e.g. crio.service) of the service to be restarted - Service names should be of the format ${NAME}${SERVICETYPE} and can up to 255 characters long. - ${NAME} must be atleast 1 character long and can only consist of alphabets, digits, ":", "-", "_", ".", and "\". - ${SERVICETYPE} must be one of ".service", ".socket", ".device", ".mount", ".automount", ".swap", ".target", ".path", ".timer", ".snapshot", ".slice" or ".scope". - maxLength: 255 - type: string - x-kubernetes-validations: - - message: Invalid ${SERVICETYPE} in service - name. Expected format is ${NAME}${SERVICETYPE}, - where ${SERVICETYPE} must be one of ".service", - ".socket", ".device", ".mount", ".automount", - ".swap", ".target", ".path", ".timer",".snapshot", - ".slice" or ".scope". - rule: self.matches('\\.(service|socket|device|mount|automount|swap|target|path|timer|snapshot|slice|scope)$') - - message: Invalid ${NAME} in service name. - Expected format is ${NAME}${SERVICETYPE}, - where {NAME} must be atleast 1 character - long and can only consist of alphabets, - digits, ":", "-", "_", ".", and "\" - rule: self.matches('^[a-zA-Z0-9:._\\\\-]+\\..') - required: - - serviceName - type: object - type: - description: |- - type represents the commands that will be carried out if this NodeDisruptionPolicyStatusActionType is executed - Valid values are Reboot, Drain, Reload, Restart, DaemonReload, None and Special. - reload/restart requires a corresponding service target specified in the reload/restart field. - Other values require no further configuration - enum: - - Reboot - - Drain - - Reload - - Restart - - DaemonReload - - None - - Special - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: reload is required when type is Reload, - and forbidden otherwise - rule: 'has(self.type) && self.type == ''Reload'' - ? has(self.reload) : !has(self.reload)' - - message: restart is required when type is Restart, - and forbidden otherwise - rule: 'has(self.type) && self.type == ''Restart'' - ? has(self.restart) : !has(self.restart)' - maxItems: 10 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - message: Reboot action can only be specified standalone, - as it will override any other actions - rule: 'self.exists(x, x.type==''Reboot'') ? size(self) - == 1 : true' - - message: None action can only be specified standalone, - as it will override any other actions - rule: 'self.exists(x, x.type==''None'') ? size(self) - == 1 : true' - path: - description: |- - path is the location of a file being managed through a MachineConfig. - The Actions in the policy will apply to changes to the file at this path. - type: string - required: - - actions - - path - type: object - maxItems: 100 - type: array - x-kubernetes-list-map-keys: - - path - x-kubernetes-list-type: map - sshkey: - description: sshkey is the overall sshkey MachineConfig definition - properties: - actions: - description: |- - actions represents the series of commands to be executed on changes to the file at - the corresponding file path. Actions will be applied in the order that - they are set in this list. If there are other incoming changes to other MachineConfig - entries in the same update that require a reboot, the reboot will supersede these actions. - Valid actions are Reboot, Drain, Reload, DaemonReload and None. - The Reboot action and the None action cannot be used in conjunction with any of the other actions. - This list supports a maximum of 10 entries. - items: - properties: - reload: - description: reload specifies the service to reload, - only valid if type is reload - properties: - serviceName: - description: |- - serviceName is the full name (e.g. crio.service) of the service to be reloaded - Service names should be of the format ${NAME}${SERVICETYPE} and can up to 255 characters long. - ${NAME} must be atleast 1 character long and can only consist of alphabets, digits, ":", "-", "_", ".", and "\". - ${SERVICETYPE} must be one of ".service", ".socket", ".device", ".mount", ".automount", ".swap", ".target", ".path", ".timer", ".snapshot", ".slice" or ".scope". - maxLength: 255 - type: string - x-kubernetes-validations: - - message: Invalid ${SERVICETYPE} in service - name. Expected format is ${NAME}${SERVICETYPE}, - where ${SERVICETYPE} must be one of ".service", - ".socket", ".device", ".mount", ".automount", - ".swap", ".target", ".path", ".timer",".snapshot", - ".slice" or ".scope". - rule: self.matches('\\.(service|socket|device|mount|automount|swap|target|path|timer|snapshot|slice|scope)$') - - message: Invalid ${NAME} in service name. - Expected format is ${NAME}${SERVICETYPE}, - where {NAME} must be atleast 1 character - long and can only consist of alphabets, - digits, ":", "-", "_", ".", and "\" - rule: self.matches('^[a-zA-Z0-9:._\\\\-]+\\..') - required: - - serviceName - type: object - restart: - description: restart specifies the service to restart, - only valid if type is restart - properties: - serviceName: - description: |- - serviceName is the full name (e.g. crio.service) of the service to be restarted - Service names should be of the format ${NAME}${SERVICETYPE} and can up to 255 characters long. - ${NAME} must be atleast 1 character long and can only consist of alphabets, digits, ":", "-", "_", ".", and "\". - ${SERVICETYPE} must be one of ".service", ".socket", ".device", ".mount", ".automount", ".swap", ".target", ".path", ".timer", ".snapshot", ".slice" or ".scope". - maxLength: 255 - type: string - x-kubernetes-validations: - - message: Invalid ${SERVICETYPE} in service - name. Expected format is ${NAME}${SERVICETYPE}, - where ${SERVICETYPE} must be one of ".service", - ".socket", ".device", ".mount", ".automount", - ".swap", ".target", ".path", ".timer",".snapshot", - ".slice" or ".scope". - rule: self.matches('\\.(service|socket|device|mount|automount|swap|target|path|timer|snapshot|slice|scope)$') - - message: Invalid ${NAME} in service name. - Expected format is ${NAME}${SERVICETYPE}, - where {NAME} must be atleast 1 character - long and can only consist of alphabets, - digits, ":", "-", "_", ".", and "\" - rule: self.matches('^[a-zA-Z0-9:._\\\\-]+\\..') - required: - - serviceName - type: object - type: - description: |- - type represents the commands that will be carried out if this NodeDisruptionPolicyStatusActionType is executed - Valid values are Reboot, Drain, Reload, Restart, DaemonReload, None and Special. - reload/restart requires a corresponding service target specified in the reload/restart field. - Other values require no further configuration - enum: - - Reboot - - Drain - - Reload - - Restart - - DaemonReload - - None - - Special - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: reload is required when type is Reload, and - forbidden otherwise - rule: 'has(self.type) && self.type == ''Reload'' ? - has(self.reload) : !has(self.reload)' - - message: restart is required when type is Restart, - and forbidden otherwise - rule: 'has(self.type) && self.type == ''Restart'' - ? has(self.restart) : !has(self.restart)' - maxItems: 10 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - message: Reboot action can only be specified standalone, - as it will override any other actions - rule: 'self.exists(x, x.type==''Reboot'') ? size(self) - == 1 : true' - - message: None action can only be specified standalone, - as it will override any other actions - rule: 'self.exists(x, x.type==''None'') ? size(self) - == 1 : true' - required: - - actions - type: object - units: - description: units is a list MachineConfig unit definitions - and actions to take on changes to those services - items: - description: NodeDisruptionPolicyStatusUnit is a systemd - unit name and corresponding actions to take and is used - in the NodeDisruptionPolicyClusterStatus object - properties: - actions: - description: |- - actions represents the series of commands to be executed on changes to the file at - the corresponding file path. Actions will be applied in the order that - they are set in this list. If there are other incoming changes to other MachineConfig - entries in the same update that require a reboot, the reboot will supersede these actions. - Valid actions are Reboot, Drain, Reload, DaemonReload and None. - The Reboot action and the None action cannot be used in conjunction with any of the other actions. - This list supports a maximum of 10 entries. - items: - properties: - reload: - description: reload specifies the service to reload, - only valid if type is reload - properties: - serviceName: - description: |- - serviceName is the full name (e.g. crio.service) of the service to be reloaded - Service names should be of the format ${NAME}${SERVICETYPE} and can up to 255 characters long. - ${NAME} must be atleast 1 character long and can only consist of alphabets, digits, ":", "-", "_", ".", and "\". - ${SERVICETYPE} must be one of ".service", ".socket", ".device", ".mount", ".automount", ".swap", ".target", ".path", ".timer", ".snapshot", ".slice" or ".scope". - maxLength: 255 - type: string - x-kubernetes-validations: - - message: Invalid ${SERVICETYPE} in service - name. Expected format is ${NAME}${SERVICETYPE}, - where ${SERVICETYPE} must be one of ".service", - ".socket", ".device", ".mount", ".automount", - ".swap", ".target", ".path", ".timer",".snapshot", - ".slice" or ".scope". - rule: self.matches('\\.(service|socket|device|mount|automount|swap|target|path|timer|snapshot|slice|scope)$') - - message: Invalid ${NAME} in service name. - Expected format is ${NAME}${SERVICETYPE}, - where {NAME} must be atleast 1 character - long and can only consist of alphabets, - digits, ":", "-", "_", ".", and "\" - rule: self.matches('^[a-zA-Z0-9:._\\\\-]+\\..') - required: - - serviceName - type: object - restart: - description: restart specifies the service to - restart, only valid if type is restart - properties: - serviceName: - description: |- - serviceName is the full name (e.g. crio.service) of the service to be restarted - Service names should be of the format ${NAME}${SERVICETYPE} and can up to 255 characters long. - ${NAME} must be atleast 1 character long and can only consist of alphabets, digits, ":", "-", "_", ".", and "\". - ${SERVICETYPE} must be one of ".service", ".socket", ".device", ".mount", ".automount", ".swap", ".target", ".path", ".timer", ".snapshot", ".slice" or ".scope". - maxLength: 255 - type: string - x-kubernetes-validations: - - message: Invalid ${SERVICETYPE} in service - name. Expected format is ${NAME}${SERVICETYPE}, - where ${SERVICETYPE} must be one of ".service", - ".socket", ".device", ".mount", ".automount", - ".swap", ".target", ".path", ".timer",".snapshot", - ".slice" or ".scope". - rule: self.matches('\\.(service|socket|device|mount|automount|swap|target|path|timer|snapshot|slice|scope)$') - - message: Invalid ${NAME} in service name. - Expected format is ${NAME}${SERVICETYPE}, - where {NAME} must be atleast 1 character - long and can only consist of alphabets, - digits, ":", "-", "_", ".", and "\" - rule: self.matches('^[a-zA-Z0-9:._\\\\-]+\\..') - required: - - serviceName - type: object - type: - description: |- - type represents the commands that will be carried out if this NodeDisruptionPolicyStatusActionType is executed - Valid values are Reboot, Drain, Reload, Restart, DaemonReload, None and Special. - reload/restart requires a corresponding service target specified in the reload/restart field. - Other values require no further configuration - enum: - - Reboot - - Drain - - Reload - - Restart - - DaemonReload - - None - - Special - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: reload is required when type is Reload, - and forbidden otherwise - rule: 'has(self.type) && self.type == ''Reload'' - ? has(self.reload) : !has(self.reload)' - - message: restart is required when type is Restart, - and forbidden otherwise - rule: 'has(self.type) && self.type == ''Restart'' - ? has(self.restart) : !has(self.restart)' - maxItems: 10 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - message: Reboot action can only be specified standalone, - as it will override any other actions - rule: 'self.exists(x, x.type==''Reboot'') ? size(self) - == 1 : true' - - message: None action can only be specified standalone, - as it will override any other actions - rule: 'self.exists(x, x.type==''None'') ? size(self) - == 1 : true' - name: - description: |- - name represents the service name of a systemd service managed through a MachineConfig - Actions specified will be applied for changes to the named service. - Service names should be of the format ${NAME}${SERVICETYPE} and can up to 255 characters long. - ${NAME} must be atleast 1 character long and can only consist of alphabets, digits, ":", "-", "_", ".", and "\". - ${SERVICETYPE} must be one of ".service", ".socket", ".device", ".mount", ".automount", ".swap", ".target", ".path", ".timer", ".snapshot", ".slice" or ".scope". - maxLength: 255 - type: string - x-kubernetes-validations: - - message: Invalid ${SERVICETYPE} in service name. Expected - format is ${NAME}${SERVICETYPE}, where ${SERVICETYPE} - must be one of ".service", ".socket", ".device", - ".mount", ".automount", ".swap", ".target", ".path", - ".timer",".snapshot", ".slice" or ".scope". - rule: self.matches('\\.(service|socket|device|mount|automount|swap|target|path|timer|snapshot|slice|scope)$') - - message: Invalid ${NAME} in service name. Expected - format is ${NAME}${SERVICETYPE}, where {NAME} must - be atleast 1 character long and can only consist - of alphabets, digits, ":", "-", "_", ".", and "\" - rule: self.matches('^[a-zA-Z0-9:._\\\\-]+\\..') - required: - - actions - - name - type: object - maxItems: 100 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - type: object - observedGeneration: - description: observedGeneration is the last generation change you've - dealt with - format: int64 - type: integer - type: object - required: - - spec - type: object - x-kubernetes-validations: - - message: when skew enforcement is in Automatic mode, a boot image configuration - is required - rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' - ? self.?spec.managedBootImages.hasValue() || self.?status.managedBootImagesStatus.hasValue() - : true' - - message: when skew enforcement is in Automatic mode, managedBootImages.machineManagers - must not be an empty list - rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' - ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || size(self.spec.managedBootImages.machineManagers) - > 0 : true' - - message: when skew enforcement is in Automatic mode, any MachineAPI MachineSet - MachineManager must use selection mode 'All' - rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' - ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || !self.spec.managedBootImages.machineManagers.exists(m, - m.resource == ''machinesets'' && m.apiGroup == ''machine.openshift.io'') - || self.spec.managedBootImages.machineManagers.exists(m, m.resource == - ''machinesets'' && m.apiGroup == ''machine.openshift.io'' && m.selection.mode - == ''All'') : true' - - message: when skew enforcement is in Automatic mode, managedBootImagesStatus - must contain a MachineManager opting in all MachineAPI MachineSets - rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' - ? !(self.?status.managedBootImagesStatus.machineManagers.hasValue()) || - self.status.managedBootImagesStatus.machineManagers.exists(m, m.selection.mode - == ''All'' && m.resource == ''machinesets'' && m.apiGroup == ''machine.openshift.io''): - true' - served: true - storage: true - subresources: - status: {} diff --git a/operator/v1/zz_generated.featuregated-crd-manifests/machineconfigurations.operator.openshift.io/IrreconcilableMachineConfig.yaml b/operator/v1/zz_generated.featuregated-crd-manifests/machineconfigurations.operator.openshift.io/IrreconcilableMachineConfig.yaml index a488e2c96ca..49b0b6c95f1 100644 --- a/operator/v1/zz_generated.featuregated-crd-manifests/machineconfigurations.operator.openshift.io/IrreconcilableMachineConfig.yaml +++ b/operator/v1/zz_generated.featuregated-crd-manifests/machineconfigurations.operator.openshift.io/IrreconcilableMachineConfig.yaml @@ -46,6 +46,98 @@ spec: description: spec is the specification of the desired behavior of the Machine Config Operator properties: + bootImageSkewEnforcement: + description: |- + bootImageSkewEnforcement allows an admin to configure how boot image version skew is + enforced on the cluster. + When omitted, this will default to Automatic for clusters that support automatic boot image updates. + For clusters that do not support automatic boot image updates, cluster upgrades will be disabled until + a skew enforcement mode has been specified. + When version skew is being enforced, cluster upgrades will be disabled until the version skew is deemed + acceptable for the current release payload. + properties: + manual: + description: |- + manual describes the current boot image of the cluster. + This should be set to the oldest boot image used amongst all machine resources in the cluster. + This must include either the RHCOS version of the boot image or the OCP release version which shipped with that + RHCOS boot image. + Required when mode is set to "Manual" and forbidden otherwise. + properties: + mode: + description: |- + mode is used to configure which boot image field is defined in Manual mode. + Valid values are OCPVersion and RHCOSVersion. + OCPVersion means that the cluster admin is expected to set the OCP version associated with the last boot image update + in the OCPVersion field. + RHCOSVersion means that the cluster admin is expected to set the RHCOS version associated with the last boot image update + in the RHCOSVersion field. + This field is required. + enum: + - OCPVersion + - RHCOSVersion + type: string + ocpVersion: + description: |- + ocpVersion provides a string which represents the OCP version of the boot image. + This field must match the OCP semver compatible format of x.y.z. This field must be between + 5 and 10 characters long. + Required when mode is set to "OCPVersion" and forbidden otherwise. + maxLength: 10 + minLength: 5 + type: string + x-kubernetes-validations: + - message: ocpVersion must match the OCP semver compatible + format of x.y.z + rule: self.matches('^[0-9]+\\.[0-9]+\\.[0-9]+$') + rhcosVersion: + description: |- + rhcosVersion provides a string which represents the RHCOS version of the boot image + This field must match rhcosVersion formatting of [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] or the legacy + format of [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]. This field must be between + 14 and 21 characters long. + Required when mode is set to "RHCOSVersion" and forbidden otherwise. + maxLength: 21 + minLength: 14 + type: string + x-kubernetes-validations: + - message: rhcosVersion must match format [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] + or must match legacy format [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber] + rule: self.matches('^[0-9]+\\.[0-9]+\\.([0-9]{8}|[0-9]{12})-[0-9]+$') + required: + - mode + type: object + x-kubernetes-validations: + - message: ocpVersion is required when mode is OCPVersion, and + forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''OCPVersion'') ? has(self.ocpVersion) + : !has(self.ocpVersion)' + - message: rhcosVersion is required when mode is RHCOSVersion, + and forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''RHCOSVersion'') ? has(self.rhcosVersion) + : !has(self.rhcosVersion)' + mode: + description: |- + mode determines the underlying behavior of skew enforcement mechanism. + Valid values are Manual and None. + Manual means that the cluster admin is expected to perform manual boot image updates and store the OCP + & RHCOS version associated with the last boot image update in the manual field. + In Manual mode, the MCO will prevent upgrades when the boot image skew exceeds the + skew limit described by the release image. + None means that the MCO will no longer monitor the boot image skew. This may affect + the cluster's ability to scale. + This field is required. + enum: + - Manual + - None + type: string + required: + - mode + type: object + x-kubernetes-validations: + - message: manual is required when mode is Manual, and forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''Manual'') ? has(self.manual) + : !has(self.manual)' failedRevisionLimit: description: |- failedRevisionLimit is the number of failed static pod installer revisions to keep on disk and in the api @@ -682,6 +774,140 @@ spec: description: status is the most recently observed status of the Machine Config Operator properties: + bootImageSkewEnforcementStatus: + description: |- + bootImageSkewEnforcementStatus reflects what the latest cluster-validated boot image skew enforcement + configuration is and will be used by Machine Config Controller while performing boot image skew enforcement. + When omitted, the MCO has no knowledge of how to enforce boot image skew. When the MCO does not know how + boot image skew should be enforced, cluster upgrades will be blocked until it can either automatically + determine skew enforcement or there is an explicit skew enforcement configuration provided in the + spec.bootImageSkewEnforcement field. + properties: + automatic: + description: |- + automatic describes the current boot image of the cluster. + This will be populated by the MCO when performing boot image updates. This value will be compared against + the cluster's skew limit to determine skew compliance. + Required when mode is set to "Automatic" and forbidden otherwise. + minProperties: 1 + properties: + ocpVersion: + description: |- + ocpVersion provides a string which represents the OCP version of the boot image. + This field must match the OCP semver compatible format of x.y.z. This field must be between + 5 and 10 characters long. + maxLength: 10 + minLength: 5 + type: string + x-kubernetes-validations: + - message: ocpVersion must match the OCP semver compatible + format of x.y.z + rule: self.matches('^[0-9]+\\.[0-9]+\\.[0-9]+$') + rhcosVersion: + description: |- + rhcosVersion provides a string which represents the RHCOS version of the boot image + This field must match rhcosVersion formatting of [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] or the legacy + format of [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]. This field must be between + 14 and 21 characters long. + maxLength: 21 + minLength: 14 + type: string + x-kubernetes-validations: + - message: rhcosVersion must match format [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] + or must match legacy format [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber] + rule: self.matches('^[0-9]+\\.[0-9]+\\.([0-9]{8}|[0-9]{12})-[0-9]+$') + type: object + x-kubernetes-validations: + - message: at least one of ocpVersion or rhcosVersion is required + rule: has(self.ocpVersion) || has(self.rhcosVersion) + manual: + description: |- + manual describes the current boot image of the cluster. + This will be populated by the MCO using the values provided in the spec.bootImageSkewEnforcement.manual field. + This value will be compared against the cluster's skew limit to determine skew compliance. + Required when mode is set to "Manual" and forbidden otherwise. + properties: + mode: + description: |- + mode is used to configure which boot image field is defined in Manual mode. + Valid values are OCPVersion and RHCOSVersion. + OCPVersion means that the cluster admin is expected to set the OCP version associated with the last boot image update + in the OCPVersion field. + RHCOSVersion means that the cluster admin is expected to set the RHCOS version associated with the last boot image update + in the RHCOSVersion field. + This field is required. + enum: + - OCPVersion + - RHCOSVersion + type: string + ocpVersion: + description: |- + ocpVersion provides a string which represents the OCP version of the boot image. + This field must match the OCP semver compatible format of x.y.z. This field must be between + 5 and 10 characters long. + Required when mode is set to "OCPVersion" and forbidden otherwise. + maxLength: 10 + minLength: 5 + type: string + x-kubernetes-validations: + - message: ocpVersion must match the OCP semver compatible + format of x.y.z + rule: self.matches('^[0-9]+\\.[0-9]+\\.[0-9]+$') + rhcosVersion: + description: |- + rhcosVersion provides a string which represents the RHCOS version of the boot image + This field must match rhcosVersion formatting of [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] or the legacy + format of [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]. This field must be between + 14 and 21 characters long. + Required when mode is set to "RHCOSVersion" and forbidden otherwise. + maxLength: 21 + minLength: 14 + type: string + x-kubernetes-validations: + - message: rhcosVersion must match format [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] + or must match legacy format [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber] + rule: self.matches('^[0-9]+\\.[0-9]+\\.([0-9]{8}|[0-9]{12})-[0-9]+$') + required: + - mode + type: object + x-kubernetes-validations: + - message: ocpVersion is required when mode is OCPVersion, and + forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''OCPVersion'') ? has(self.ocpVersion) + : !has(self.ocpVersion)' + - message: rhcosVersion is required when mode is RHCOSVersion, + and forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''RHCOSVersion'') ? has(self.rhcosVersion) + : !has(self.rhcosVersion)' + mode: + description: |- + mode determines the underlying behavior of skew enforcement mechanism. + Valid values are Automatic, Manual and None. + Automatic means that the MCO will perform boot image updates and store the + OCP & RHCOS version associated with the last boot image update in the automatic field. + Manual means that the cluster admin is expected to perform manual boot image updates and store the OCP + & RHCOS version associated with the last boot image update in the manual field. + In Automatic and Manual mode, the MCO will prevent upgrades when the boot image skew exceeds the + skew limit described by the release image. + None means that the MCO will no longer monitor the boot image skew. This may affect + the cluster's ability to scale. + This field is required. + enum: + - Automatic + - Manual + - None + type: string + required: + - mode + type: object + x-kubernetes-validations: + - message: automatic is required when mode is Automatic, and forbidden + otherwise + rule: 'has(self.mode) && (self.mode == ''Automatic'') ? has(self.automatic) + : !has(self.automatic)' + - message: manual is required when mode is Manual, and forbidden otherwise + rule: 'has(self.mode) && (self.mode == ''Manual'') ? has(self.manual) + : !has(self.manual)' conditions: description: conditions is a list of conditions and their status items: @@ -1276,6 +1502,32 @@ spec: required: - spec type: object + x-kubernetes-validations: + - message: when skew enforcement is in Automatic mode, a boot image configuration + is required + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? self.?spec.managedBootImages.hasValue() || self.?status.managedBootImagesStatus.hasValue() + : true' + - message: when skew enforcement is in Automatic mode, managedBootImages.machineManagers + must not be an empty list + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || size(self.spec.managedBootImages.machineManagers) + > 0 : true' + - message: when skew enforcement is in Automatic mode, any MachineAPI MachineSet + MachineManager must use selection mode 'All' + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || !self.spec.managedBootImages.machineManagers.exists(m, + m.resource == ''machinesets'' && m.apiGroup == ''machine.openshift.io'') + || self.spec.managedBootImages.machineManagers.exists(m, m.resource == + ''machinesets'' && m.apiGroup == ''machine.openshift.io'' && m.selection.mode + == ''All'') : true' + - message: when skew enforcement is in Automatic mode, managedBootImagesStatus + must contain a MachineManager opting in all MachineAPI MachineSets + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? !(self.?status.managedBootImagesStatus.machineManagers.hasValue()) || + self.status.managedBootImagesStatus.machineManagers.exists(m, m.selection.mode + == ''All'' && m.resource == ''machinesets'' && m.apiGroup == ''machine.openshift.io''): + true' served: true storage: true subresources: diff --git a/operator/v1/zz_generated.featuregated-crd-manifests/machineconfigurations.operator.openshift.io/ManagedBootImagesAWSCAPI.yaml b/operator/v1/zz_generated.featuregated-crd-manifests/machineconfigurations.operator.openshift.io/ManagedBootImagesAWSCAPI.yaml index 52f9c67ec67..791db0d70d0 100644 --- a/operator/v1/zz_generated.featuregated-crd-manifests/machineconfigurations.operator.openshift.io/ManagedBootImagesAWSCAPI.yaml +++ b/operator/v1/zz_generated.featuregated-crd-manifests/machineconfigurations.operator.openshift.io/ManagedBootImagesAWSCAPI.yaml @@ -46,6 +46,98 @@ spec: description: spec is the specification of the desired behavior of the Machine Config Operator properties: + bootImageSkewEnforcement: + description: |- + bootImageSkewEnforcement allows an admin to configure how boot image version skew is + enforced on the cluster. + When omitted, this will default to Automatic for clusters that support automatic boot image updates. + For clusters that do not support automatic boot image updates, cluster upgrades will be disabled until + a skew enforcement mode has been specified. + When version skew is being enforced, cluster upgrades will be disabled until the version skew is deemed + acceptable for the current release payload. + properties: + manual: + description: |- + manual describes the current boot image of the cluster. + This should be set to the oldest boot image used amongst all machine resources in the cluster. + This must include either the RHCOS version of the boot image or the OCP release version which shipped with that + RHCOS boot image. + Required when mode is set to "Manual" and forbidden otherwise. + properties: + mode: + description: |- + mode is used to configure which boot image field is defined in Manual mode. + Valid values are OCPVersion and RHCOSVersion. + OCPVersion means that the cluster admin is expected to set the OCP version associated with the last boot image update + in the OCPVersion field. + RHCOSVersion means that the cluster admin is expected to set the RHCOS version associated with the last boot image update + in the RHCOSVersion field. + This field is required. + enum: + - OCPVersion + - RHCOSVersion + type: string + ocpVersion: + description: |- + ocpVersion provides a string which represents the OCP version of the boot image. + This field must match the OCP semver compatible format of x.y.z. This field must be between + 5 and 10 characters long. + Required when mode is set to "OCPVersion" and forbidden otherwise. + maxLength: 10 + minLength: 5 + type: string + x-kubernetes-validations: + - message: ocpVersion must match the OCP semver compatible + format of x.y.z + rule: self.matches('^[0-9]+\\.[0-9]+\\.[0-9]+$') + rhcosVersion: + description: |- + rhcosVersion provides a string which represents the RHCOS version of the boot image + This field must match rhcosVersion formatting of [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] or the legacy + format of [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]. This field must be between + 14 and 21 characters long. + Required when mode is set to "RHCOSVersion" and forbidden otherwise. + maxLength: 21 + minLength: 14 + type: string + x-kubernetes-validations: + - message: rhcosVersion must match format [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] + or must match legacy format [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber] + rule: self.matches('^[0-9]+\\.[0-9]+\\.([0-9]{8}|[0-9]{12})-[0-9]+$') + required: + - mode + type: object + x-kubernetes-validations: + - message: ocpVersion is required when mode is OCPVersion, and + forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''OCPVersion'') ? has(self.ocpVersion) + : !has(self.ocpVersion)' + - message: rhcosVersion is required when mode is RHCOSVersion, + and forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''RHCOSVersion'') ? has(self.rhcosVersion) + : !has(self.rhcosVersion)' + mode: + description: |- + mode determines the underlying behavior of skew enforcement mechanism. + Valid values are Manual and None. + Manual means that the cluster admin is expected to perform manual boot image updates and store the OCP + & RHCOS version associated with the last boot image update in the manual field. + In Manual mode, the MCO will prevent upgrades when the boot image skew exceeds the + skew limit described by the release image. + None means that the MCO will no longer monitor the boot image skew. This may affect + the cluster's ability to scale. + This field is required. + enum: + - Manual + - None + type: string + required: + - mode + type: object + x-kubernetes-validations: + - message: manual is required when mode is Manual, and forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''Manual'') ? has(self.manual) + : !has(self.manual)' failedRevisionLimit: description: |- failedRevisionLimit is the number of failed static pod installer revisions to keep on disk and in the api @@ -660,6 +752,140 @@ spec: description: status is the most recently observed status of the Machine Config Operator properties: + bootImageSkewEnforcementStatus: + description: |- + bootImageSkewEnforcementStatus reflects what the latest cluster-validated boot image skew enforcement + configuration is and will be used by Machine Config Controller while performing boot image skew enforcement. + When omitted, the MCO has no knowledge of how to enforce boot image skew. When the MCO does not know how + boot image skew should be enforced, cluster upgrades will be blocked until it can either automatically + determine skew enforcement or there is an explicit skew enforcement configuration provided in the + spec.bootImageSkewEnforcement field. + properties: + automatic: + description: |- + automatic describes the current boot image of the cluster. + This will be populated by the MCO when performing boot image updates. This value will be compared against + the cluster's skew limit to determine skew compliance. + Required when mode is set to "Automatic" and forbidden otherwise. + minProperties: 1 + properties: + ocpVersion: + description: |- + ocpVersion provides a string which represents the OCP version of the boot image. + This field must match the OCP semver compatible format of x.y.z. This field must be between + 5 and 10 characters long. + maxLength: 10 + minLength: 5 + type: string + x-kubernetes-validations: + - message: ocpVersion must match the OCP semver compatible + format of x.y.z + rule: self.matches('^[0-9]+\\.[0-9]+\\.[0-9]+$') + rhcosVersion: + description: |- + rhcosVersion provides a string which represents the RHCOS version of the boot image + This field must match rhcosVersion formatting of [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] or the legacy + format of [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]. This field must be between + 14 and 21 characters long. + maxLength: 21 + minLength: 14 + type: string + x-kubernetes-validations: + - message: rhcosVersion must match format [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] + or must match legacy format [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber] + rule: self.matches('^[0-9]+\\.[0-9]+\\.([0-9]{8}|[0-9]{12})-[0-9]+$') + type: object + x-kubernetes-validations: + - message: at least one of ocpVersion or rhcosVersion is required + rule: has(self.ocpVersion) || has(self.rhcosVersion) + manual: + description: |- + manual describes the current boot image of the cluster. + This will be populated by the MCO using the values provided in the spec.bootImageSkewEnforcement.manual field. + This value will be compared against the cluster's skew limit to determine skew compliance. + Required when mode is set to "Manual" and forbidden otherwise. + properties: + mode: + description: |- + mode is used to configure which boot image field is defined in Manual mode. + Valid values are OCPVersion and RHCOSVersion. + OCPVersion means that the cluster admin is expected to set the OCP version associated with the last boot image update + in the OCPVersion field. + RHCOSVersion means that the cluster admin is expected to set the RHCOS version associated with the last boot image update + in the RHCOSVersion field. + This field is required. + enum: + - OCPVersion + - RHCOSVersion + type: string + ocpVersion: + description: |- + ocpVersion provides a string which represents the OCP version of the boot image. + This field must match the OCP semver compatible format of x.y.z. This field must be between + 5 and 10 characters long. + Required when mode is set to "OCPVersion" and forbidden otherwise. + maxLength: 10 + minLength: 5 + type: string + x-kubernetes-validations: + - message: ocpVersion must match the OCP semver compatible + format of x.y.z + rule: self.matches('^[0-9]+\\.[0-9]+\\.[0-9]+$') + rhcosVersion: + description: |- + rhcosVersion provides a string which represents the RHCOS version of the boot image + This field must match rhcosVersion formatting of [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] or the legacy + format of [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]. This field must be between + 14 and 21 characters long. + Required when mode is set to "RHCOSVersion" and forbidden otherwise. + maxLength: 21 + minLength: 14 + type: string + x-kubernetes-validations: + - message: rhcosVersion must match format [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] + or must match legacy format [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber] + rule: self.matches('^[0-9]+\\.[0-9]+\\.([0-9]{8}|[0-9]{12})-[0-9]+$') + required: + - mode + type: object + x-kubernetes-validations: + - message: ocpVersion is required when mode is OCPVersion, and + forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''OCPVersion'') ? has(self.ocpVersion) + : !has(self.ocpVersion)' + - message: rhcosVersion is required when mode is RHCOSVersion, + and forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''RHCOSVersion'') ? has(self.rhcosVersion) + : !has(self.rhcosVersion)' + mode: + description: |- + mode determines the underlying behavior of skew enforcement mechanism. + Valid values are Automatic, Manual and None. + Automatic means that the MCO will perform boot image updates and store the + OCP & RHCOS version associated with the last boot image update in the automatic field. + Manual means that the cluster admin is expected to perform manual boot image updates and store the OCP + & RHCOS version associated with the last boot image update in the manual field. + In Automatic and Manual mode, the MCO will prevent upgrades when the boot image skew exceeds the + skew limit described by the release image. + None means that the MCO will no longer monitor the boot image skew. This may affect + the cluster's ability to scale. + This field is required. + enum: + - Automatic + - Manual + - None + type: string + required: + - mode + type: object + x-kubernetes-validations: + - message: automatic is required when mode is Automatic, and forbidden + otherwise + rule: 'has(self.mode) && (self.mode == ''Automatic'') ? has(self.automatic) + : !has(self.automatic)' + - message: manual is required when mode is Manual, and forbidden otherwise + rule: 'has(self.mode) && (self.mode == ''Manual'') ? has(self.manual) + : !has(self.manual)' conditions: description: conditions is a list of conditions and their status items: @@ -1265,6 +1491,32 @@ spec: required: - spec type: object + x-kubernetes-validations: + - message: when skew enforcement is in Automatic mode, a boot image configuration + is required + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? self.?spec.managedBootImages.hasValue() || self.?status.managedBootImagesStatus.hasValue() + : true' + - message: when skew enforcement is in Automatic mode, managedBootImages.machineManagers + must not be an empty list + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || size(self.spec.managedBootImages.machineManagers) + > 0 : true' + - message: when skew enforcement is in Automatic mode, any MachineAPI MachineSet + MachineManager must use selection mode 'All' + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || !self.spec.managedBootImages.machineManagers.exists(m, + m.resource == ''machinesets'' && m.apiGroup == ''machine.openshift.io'') + || self.spec.managedBootImages.machineManagers.exists(m, m.resource == + ''machinesets'' && m.apiGroup == ''machine.openshift.io'' && m.selection.mode + == ''All'') : true' + - message: when skew enforcement is in Automatic mode, managedBootImagesStatus + must contain a MachineManager opting in all MachineAPI MachineSets + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? !(self.?status.managedBootImagesStatus.machineManagers.hasValue()) || + self.status.managedBootImagesStatus.machineManagers.exists(m, m.selection.mode + == ''All'' && m.resource == ''machinesets'' && m.apiGroup == ''machine.openshift.io''): + true' served: true storage: true subresources: diff --git a/operator/v1/zz_generated.featuregated-crd-manifests/machineconfigurations.operator.openshift.io/ManagedBootImagesCPMS+ManagedBootImagesAWSCAPI.yaml b/operator/v1/zz_generated.featuregated-crd-manifests/machineconfigurations.operator.openshift.io/ManagedBootImagesCPMS+ManagedBootImagesAWSCAPI.yaml index a569f879d9c..c65c0c70d46 100644 --- a/operator/v1/zz_generated.featuregated-crd-manifests/machineconfigurations.operator.openshift.io/ManagedBootImagesCPMS+ManagedBootImagesAWSCAPI.yaml +++ b/operator/v1/zz_generated.featuregated-crd-manifests/machineconfigurations.operator.openshift.io/ManagedBootImagesCPMS+ManagedBootImagesAWSCAPI.yaml @@ -47,6 +47,98 @@ spec: description: spec is the specification of the desired behavior of the Machine Config Operator properties: + bootImageSkewEnforcement: + description: |- + bootImageSkewEnforcement allows an admin to configure how boot image version skew is + enforced on the cluster. + When omitted, this will default to Automatic for clusters that support automatic boot image updates. + For clusters that do not support automatic boot image updates, cluster upgrades will be disabled until + a skew enforcement mode has been specified. + When version skew is being enforced, cluster upgrades will be disabled until the version skew is deemed + acceptable for the current release payload. + properties: + manual: + description: |- + manual describes the current boot image of the cluster. + This should be set to the oldest boot image used amongst all machine resources in the cluster. + This must include either the RHCOS version of the boot image or the OCP release version which shipped with that + RHCOS boot image. + Required when mode is set to "Manual" and forbidden otherwise. + properties: + mode: + description: |- + mode is used to configure which boot image field is defined in Manual mode. + Valid values are OCPVersion and RHCOSVersion. + OCPVersion means that the cluster admin is expected to set the OCP version associated with the last boot image update + in the OCPVersion field. + RHCOSVersion means that the cluster admin is expected to set the RHCOS version associated with the last boot image update + in the RHCOSVersion field. + This field is required. + enum: + - OCPVersion + - RHCOSVersion + type: string + ocpVersion: + description: |- + ocpVersion provides a string which represents the OCP version of the boot image. + This field must match the OCP semver compatible format of x.y.z. This field must be between + 5 and 10 characters long. + Required when mode is set to "OCPVersion" and forbidden otherwise. + maxLength: 10 + minLength: 5 + type: string + x-kubernetes-validations: + - message: ocpVersion must match the OCP semver compatible + format of x.y.z + rule: self.matches('^[0-9]+\\.[0-9]+\\.[0-9]+$') + rhcosVersion: + description: |- + rhcosVersion provides a string which represents the RHCOS version of the boot image + This field must match rhcosVersion formatting of [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] or the legacy + format of [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]. This field must be between + 14 and 21 characters long. + Required when mode is set to "RHCOSVersion" and forbidden otherwise. + maxLength: 21 + minLength: 14 + type: string + x-kubernetes-validations: + - message: rhcosVersion must match format [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] + or must match legacy format [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber] + rule: self.matches('^[0-9]+\\.[0-9]+\\.([0-9]{8}|[0-9]{12})-[0-9]+$') + required: + - mode + type: object + x-kubernetes-validations: + - message: ocpVersion is required when mode is OCPVersion, and + forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''OCPVersion'') ? has(self.ocpVersion) + : !has(self.ocpVersion)' + - message: rhcosVersion is required when mode is RHCOSVersion, + and forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''RHCOSVersion'') ? has(self.rhcosVersion) + : !has(self.rhcosVersion)' + mode: + description: |- + mode determines the underlying behavior of skew enforcement mechanism. + Valid values are Manual and None. + Manual means that the cluster admin is expected to perform manual boot image updates and store the OCP + & RHCOS version associated with the last boot image update in the manual field. + In Manual mode, the MCO will prevent upgrades when the boot image skew exceeds the + skew limit described by the release image. + None means that the MCO will no longer monitor the boot image skew. This may affect + the cluster's ability to scale. + This field is required. + enum: + - Manual + - None + type: string + required: + - mode + type: object + x-kubernetes-validations: + - message: manual is required when mode is Manual, and forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''Manual'') ? has(self.manual) + : !has(self.manual)' failedRevisionLimit: description: |- failedRevisionLimit is the number of failed static pod installer revisions to keep on disk and in the api @@ -670,6 +762,140 @@ spec: description: status is the most recently observed status of the Machine Config Operator properties: + bootImageSkewEnforcementStatus: + description: |- + bootImageSkewEnforcementStatus reflects what the latest cluster-validated boot image skew enforcement + configuration is and will be used by Machine Config Controller while performing boot image skew enforcement. + When omitted, the MCO has no knowledge of how to enforce boot image skew. When the MCO does not know how + boot image skew should be enforced, cluster upgrades will be blocked until it can either automatically + determine skew enforcement or there is an explicit skew enforcement configuration provided in the + spec.bootImageSkewEnforcement field. + properties: + automatic: + description: |- + automatic describes the current boot image of the cluster. + This will be populated by the MCO when performing boot image updates. This value will be compared against + the cluster's skew limit to determine skew compliance. + Required when mode is set to "Automatic" and forbidden otherwise. + minProperties: 1 + properties: + ocpVersion: + description: |- + ocpVersion provides a string which represents the OCP version of the boot image. + This field must match the OCP semver compatible format of x.y.z. This field must be between + 5 and 10 characters long. + maxLength: 10 + minLength: 5 + type: string + x-kubernetes-validations: + - message: ocpVersion must match the OCP semver compatible + format of x.y.z + rule: self.matches('^[0-9]+\\.[0-9]+\\.[0-9]+$') + rhcosVersion: + description: |- + rhcosVersion provides a string which represents the RHCOS version of the boot image + This field must match rhcosVersion formatting of [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] or the legacy + format of [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]. This field must be between + 14 and 21 characters long. + maxLength: 21 + minLength: 14 + type: string + x-kubernetes-validations: + - message: rhcosVersion must match format [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] + or must match legacy format [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber] + rule: self.matches('^[0-9]+\\.[0-9]+\\.([0-9]{8}|[0-9]{12})-[0-9]+$') + type: object + x-kubernetes-validations: + - message: at least one of ocpVersion or rhcosVersion is required + rule: has(self.ocpVersion) || has(self.rhcosVersion) + manual: + description: |- + manual describes the current boot image of the cluster. + This will be populated by the MCO using the values provided in the spec.bootImageSkewEnforcement.manual field. + This value will be compared against the cluster's skew limit to determine skew compliance. + Required when mode is set to "Manual" and forbidden otherwise. + properties: + mode: + description: |- + mode is used to configure which boot image field is defined in Manual mode. + Valid values are OCPVersion and RHCOSVersion. + OCPVersion means that the cluster admin is expected to set the OCP version associated with the last boot image update + in the OCPVersion field. + RHCOSVersion means that the cluster admin is expected to set the RHCOS version associated with the last boot image update + in the RHCOSVersion field. + This field is required. + enum: + - OCPVersion + - RHCOSVersion + type: string + ocpVersion: + description: |- + ocpVersion provides a string which represents the OCP version of the boot image. + This field must match the OCP semver compatible format of x.y.z. This field must be between + 5 and 10 characters long. + Required when mode is set to "OCPVersion" and forbidden otherwise. + maxLength: 10 + minLength: 5 + type: string + x-kubernetes-validations: + - message: ocpVersion must match the OCP semver compatible + format of x.y.z + rule: self.matches('^[0-9]+\\.[0-9]+\\.[0-9]+$') + rhcosVersion: + description: |- + rhcosVersion provides a string which represents the RHCOS version of the boot image + This field must match rhcosVersion formatting of [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] or the legacy + format of [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]. This field must be between + 14 and 21 characters long. + Required when mode is set to "RHCOSVersion" and forbidden otherwise. + maxLength: 21 + minLength: 14 + type: string + x-kubernetes-validations: + - message: rhcosVersion must match format [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] + or must match legacy format [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber] + rule: self.matches('^[0-9]+\\.[0-9]+\\.([0-9]{8}|[0-9]{12})-[0-9]+$') + required: + - mode + type: object + x-kubernetes-validations: + - message: ocpVersion is required when mode is OCPVersion, and + forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''OCPVersion'') ? has(self.ocpVersion) + : !has(self.ocpVersion)' + - message: rhcosVersion is required when mode is RHCOSVersion, + and forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''RHCOSVersion'') ? has(self.rhcosVersion) + : !has(self.rhcosVersion)' + mode: + description: |- + mode determines the underlying behavior of skew enforcement mechanism. + Valid values are Automatic, Manual and None. + Automatic means that the MCO will perform boot image updates and store the + OCP & RHCOS version associated with the last boot image update in the automatic field. + Manual means that the cluster admin is expected to perform manual boot image updates and store the OCP + & RHCOS version associated with the last boot image update in the manual field. + In Automatic and Manual mode, the MCO will prevent upgrades when the boot image skew exceeds the + skew limit described by the release image. + None means that the MCO will no longer monitor the boot image skew. This may affect + the cluster's ability to scale. + This field is required. + enum: + - Automatic + - Manual + - None + type: string + required: + - mode + type: object + x-kubernetes-validations: + - message: automatic is required when mode is Automatic, and forbidden + otherwise + rule: 'has(self.mode) && (self.mode == ''Automatic'') ? has(self.automatic) + : !has(self.automatic)' + - message: manual is required when mode is Manual, and forbidden otherwise + rule: 'has(self.mode) && (self.mode == ''Manual'') ? has(self.manual) + : !has(self.manual)' conditions: description: conditions is a list of conditions and their status items: @@ -1284,6 +1510,32 @@ spec: required: - spec type: object + x-kubernetes-validations: + - message: when skew enforcement is in Automatic mode, a boot image configuration + is required + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? self.?spec.managedBootImages.hasValue() || self.?status.managedBootImagesStatus.hasValue() + : true' + - message: when skew enforcement is in Automatic mode, managedBootImages.machineManagers + must not be an empty list + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || size(self.spec.managedBootImages.machineManagers) + > 0 : true' + - message: when skew enforcement is in Automatic mode, any MachineAPI MachineSet + MachineManager must use selection mode 'All' + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || !self.spec.managedBootImages.machineManagers.exists(m, + m.resource == ''machinesets'' && m.apiGroup == ''machine.openshift.io'') + || self.spec.managedBootImages.machineManagers.exists(m, m.resource == + ''machinesets'' && m.apiGroup == ''machine.openshift.io'' && m.selection.mode + == ''All'') : true' + - message: when skew enforcement is in Automatic mode, managedBootImagesStatus + must contain a MachineManager opting in all MachineAPI MachineSets + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? !(self.?status.managedBootImagesStatus.machineManagers.hasValue()) || + self.status.managedBootImagesStatus.machineManagers.exists(m, m.selection.mode + == ''All'' && m.resource == ''machinesets'' && m.apiGroup == ''machine.openshift.io''): + true' served: true storage: true subresources: diff --git a/operator/v1/zz_generated.featuregated-crd-manifests/machineconfigurations.operator.openshift.io/ManagedBootImagesCPMS.yaml b/operator/v1/zz_generated.featuregated-crd-manifests/machineconfigurations.operator.openshift.io/ManagedBootImagesCPMS.yaml index e232c99bc6f..a798ba719ec 100644 --- a/operator/v1/zz_generated.featuregated-crd-manifests/machineconfigurations.operator.openshift.io/ManagedBootImagesCPMS.yaml +++ b/operator/v1/zz_generated.featuregated-crd-manifests/machineconfigurations.operator.openshift.io/ManagedBootImagesCPMS.yaml @@ -46,6 +46,98 @@ spec: description: spec is the specification of the desired behavior of the Machine Config Operator properties: + bootImageSkewEnforcement: + description: |- + bootImageSkewEnforcement allows an admin to configure how boot image version skew is + enforced on the cluster. + When omitted, this will default to Automatic for clusters that support automatic boot image updates. + For clusters that do not support automatic boot image updates, cluster upgrades will be disabled until + a skew enforcement mode has been specified. + When version skew is being enforced, cluster upgrades will be disabled until the version skew is deemed + acceptable for the current release payload. + properties: + manual: + description: |- + manual describes the current boot image of the cluster. + This should be set to the oldest boot image used amongst all machine resources in the cluster. + This must include either the RHCOS version of the boot image or the OCP release version which shipped with that + RHCOS boot image. + Required when mode is set to "Manual" and forbidden otherwise. + properties: + mode: + description: |- + mode is used to configure which boot image field is defined in Manual mode. + Valid values are OCPVersion and RHCOSVersion. + OCPVersion means that the cluster admin is expected to set the OCP version associated with the last boot image update + in the OCPVersion field. + RHCOSVersion means that the cluster admin is expected to set the RHCOS version associated with the last boot image update + in the RHCOSVersion field. + This field is required. + enum: + - OCPVersion + - RHCOSVersion + type: string + ocpVersion: + description: |- + ocpVersion provides a string which represents the OCP version of the boot image. + This field must match the OCP semver compatible format of x.y.z. This field must be between + 5 and 10 characters long. + Required when mode is set to "OCPVersion" and forbidden otherwise. + maxLength: 10 + minLength: 5 + type: string + x-kubernetes-validations: + - message: ocpVersion must match the OCP semver compatible + format of x.y.z + rule: self.matches('^[0-9]+\\.[0-9]+\\.[0-9]+$') + rhcosVersion: + description: |- + rhcosVersion provides a string which represents the RHCOS version of the boot image + This field must match rhcosVersion formatting of [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] or the legacy + format of [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]. This field must be between + 14 and 21 characters long. + Required when mode is set to "RHCOSVersion" and forbidden otherwise. + maxLength: 21 + minLength: 14 + type: string + x-kubernetes-validations: + - message: rhcosVersion must match format [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] + or must match legacy format [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber] + rule: self.matches('^[0-9]+\\.[0-9]+\\.([0-9]{8}|[0-9]{12})-[0-9]+$') + required: + - mode + type: object + x-kubernetes-validations: + - message: ocpVersion is required when mode is OCPVersion, and + forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''OCPVersion'') ? has(self.ocpVersion) + : !has(self.ocpVersion)' + - message: rhcosVersion is required when mode is RHCOSVersion, + and forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''RHCOSVersion'') ? has(self.rhcosVersion) + : !has(self.rhcosVersion)' + mode: + description: |- + mode determines the underlying behavior of skew enforcement mechanism. + Valid values are Manual and None. + Manual means that the cluster admin is expected to perform manual boot image updates and store the OCP + & RHCOS version associated with the last boot image update in the manual field. + In Manual mode, the MCO will prevent upgrades when the boot image skew exceeds the + skew limit described by the release image. + None means that the MCO will no longer monitor the boot image skew. This may affect + the cluster's ability to scale. + This field is required. + enum: + - Manual + - None + type: string + required: + - mode + type: object + x-kubernetes-validations: + - message: manual is required when mode is Manual, and forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''Manual'') ? has(self.manual) + : !has(self.manual)' failedRevisionLimit: description: |- failedRevisionLimit is the number of failed static pod installer revisions to keep on disk and in the api @@ -657,6 +749,140 @@ spec: description: status is the most recently observed status of the Machine Config Operator properties: + bootImageSkewEnforcementStatus: + description: |- + bootImageSkewEnforcementStatus reflects what the latest cluster-validated boot image skew enforcement + configuration is and will be used by Machine Config Controller while performing boot image skew enforcement. + When omitted, the MCO has no knowledge of how to enforce boot image skew. When the MCO does not know how + boot image skew should be enforced, cluster upgrades will be blocked until it can either automatically + determine skew enforcement or there is an explicit skew enforcement configuration provided in the + spec.bootImageSkewEnforcement field. + properties: + automatic: + description: |- + automatic describes the current boot image of the cluster. + This will be populated by the MCO when performing boot image updates. This value will be compared against + the cluster's skew limit to determine skew compliance. + Required when mode is set to "Automatic" and forbidden otherwise. + minProperties: 1 + properties: + ocpVersion: + description: |- + ocpVersion provides a string which represents the OCP version of the boot image. + This field must match the OCP semver compatible format of x.y.z. This field must be between + 5 and 10 characters long. + maxLength: 10 + minLength: 5 + type: string + x-kubernetes-validations: + - message: ocpVersion must match the OCP semver compatible + format of x.y.z + rule: self.matches('^[0-9]+\\.[0-9]+\\.[0-9]+$') + rhcosVersion: + description: |- + rhcosVersion provides a string which represents the RHCOS version of the boot image + This field must match rhcosVersion formatting of [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] or the legacy + format of [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]. This field must be between + 14 and 21 characters long. + maxLength: 21 + minLength: 14 + type: string + x-kubernetes-validations: + - message: rhcosVersion must match format [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] + or must match legacy format [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber] + rule: self.matches('^[0-9]+\\.[0-9]+\\.([0-9]{8}|[0-9]{12})-[0-9]+$') + type: object + x-kubernetes-validations: + - message: at least one of ocpVersion or rhcosVersion is required + rule: has(self.ocpVersion) || has(self.rhcosVersion) + manual: + description: |- + manual describes the current boot image of the cluster. + This will be populated by the MCO using the values provided in the spec.bootImageSkewEnforcement.manual field. + This value will be compared against the cluster's skew limit to determine skew compliance. + Required when mode is set to "Manual" and forbidden otherwise. + properties: + mode: + description: |- + mode is used to configure which boot image field is defined in Manual mode. + Valid values are OCPVersion and RHCOSVersion. + OCPVersion means that the cluster admin is expected to set the OCP version associated with the last boot image update + in the OCPVersion field. + RHCOSVersion means that the cluster admin is expected to set the RHCOS version associated with the last boot image update + in the RHCOSVersion field. + This field is required. + enum: + - OCPVersion + - RHCOSVersion + type: string + ocpVersion: + description: |- + ocpVersion provides a string which represents the OCP version of the boot image. + This field must match the OCP semver compatible format of x.y.z. This field must be between + 5 and 10 characters long. + Required when mode is set to "OCPVersion" and forbidden otherwise. + maxLength: 10 + minLength: 5 + type: string + x-kubernetes-validations: + - message: ocpVersion must match the OCP semver compatible + format of x.y.z + rule: self.matches('^[0-9]+\\.[0-9]+\\.[0-9]+$') + rhcosVersion: + description: |- + rhcosVersion provides a string which represents the RHCOS version of the boot image + This field must match rhcosVersion formatting of [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] or the legacy + format of [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]. This field must be between + 14 and 21 characters long. + Required when mode is set to "RHCOSVersion" and forbidden otherwise. + maxLength: 21 + minLength: 14 + type: string + x-kubernetes-validations: + - message: rhcosVersion must match format [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] + or must match legacy format [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber] + rule: self.matches('^[0-9]+\\.[0-9]+\\.([0-9]{8}|[0-9]{12})-[0-9]+$') + required: + - mode + type: object + x-kubernetes-validations: + - message: ocpVersion is required when mode is OCPVersion, and + forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''OCPVersion'') ? has(self.ocpVersion) + : !has(self.ocpVersion)' + - message: rhcosVersion is required when mode is RHCOSVersion, + and forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''RHCOSVersion'') ? has(self.rhcosVersion) + : !has(self.rhcosVersion)' + mode: + description: |- + mode determines the underlying behavior of skew enforcement mechanism. + Valid values are Automatic, Manual and None. + Automatic means that the MCO will perform boot image updates and store the + OCP & RHCOS version associated with the last boot image update in the automatic field. + Manual means that the cluster admin is expected to perform manual boot image updates and store the OCP + & RHCOS version associated with the last boot image update in the manual field. + In Automatic and Manual mode, the MCO will prevent upgrades when the boot image skew exceeds the + skew limit described by the release image. + None means that the MCO will no longer monitor the boot image skew. This may affect + the cluster's ability to scale. + This field is required. + enum: + - Automatic + - Manual + - None + type: string + required: + - mode + type: object + x-kubernetes-validations: + - message: automatic is required when mode is Automatic, and forbidden + otherwise + rule: 'has(self.mode) && (self.mode == ''Automatic'') ? has(self.automatic) + : !has(self.automatic)' + - message: manual is required when mode is Manual, and forbidden otherwise + rule: 'has(self.mode) && (self.mode == ''Manual'') ? has(self.manual) + : !has(self.manual)' conditions: description: conditions is a list of conditions and their status items: @@ -1259,6 +1485,32 @@ spec: required: - spec type: object + x-kubernetes-validations: + - message: when skew enforcement is in Automatic mode, a boot image configuration + is required + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? self.?spec.managedBootImages.hasValue() || self.?status.managedBootImagesStatus.hasValue() + : true' + - message: when skew enforcement is in Automatic mode, managedBootImages.machineManagers + must not be an empty list + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || size(self.spec.managedBootImages.machineManagers) + > 0 : true' + - message: when skew enforcement is in Automatic mode, any MachineAPI MachineSet + MachineManager must use selection mode 'All' + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || !self.spec.managedBootImages.machineManagers.exists(m, + m.resource == ''machinesets'' && m.apiGroup == ''machine.openshift.io'') + || self.spec.managedBootImages.machineManagers.exists(m, m.resource == + ''machinesets'' && m.apiGroup == ''machine.openshift.io'' && m.selection.mode + == ''All'') : true' + - message: when skew enforcement is in Automatic mode, managedBootImagesStatus + must contain a MachineManager opting in all MachineAPI MachineSets + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? !(self.?status.managedBootImagesStatus.machineManagers.hasValue()) || + self.status.managedBootImagesStatus.machineManagers.exists(m, m.selection.mode + == ''All'' && m.resource == ''machinesets'' && m.apiGroup == ''machine.openshift.io''): + true' served: true storage: true subresources: diff --git a/payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml b/payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml index 5b31be013e8..04b7ebc8bb2 100644 --- a/payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml +++ b/payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml @@ -295,9 +295,6 @@ { "name": "AdditionalStorageConfig" }, - { - "name": "BootImageSkewEnforcement" - }, { "name": "BuildCSIVolumes" }, diff --git a/payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml b/payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml index a5ac17f75da..392c736bc23 100644 --- a/payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml +++ b/payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml @@ -120,9 +120,6 @@ { "name": "BGPBasedVIPManagement" }, - { - "name": "BootImageSkewEnforcement" - }, { "name": "BootcNodeManagement" }, diff --git a/payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml b/payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml index 725876b8686..e552a2ac528 100644 --- a/payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml +++ b/payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml @@ -294,9 +294,6 @@ { "name": "AdditionalStorageConfig" }, - { - "name": "BootImageSkewEnforcement" - }, { "name": "BuildCSIVolumes" }, diff --git a/payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml b/payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml index ba3e0553bc2..91ec549da39 100644 --- a/payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml +++ b/payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml @@ -150,9 +150,6 @@ { "name": "AzureMultiDisk" }, - { - "name": "BootImageSkewEnforcement" - }, { "name": "BootcNodeManagement" }, diff --git a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml index e8da61aebc8..e09d6706397 100644 --- a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml +++ b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml @@ -283,9 +283,6 @@ { "name": "AdditionalStorageConfig" }, - { - "name": "BootImageSkewEnforcement" - }, { "name": "BuildCSIVolumes" }, diff --git a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml index 54764f1148a..4313ebc411e 100644 --- a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml +++ b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml @@ -90,9 +90,6 @@ { "name": "BGPBasedVIPManagement" }, - { - "name": "BootImageSkewEnforcement" - }, { "name": "BootcNodeManagement" }, diff --git a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml index d85ffdb27b2..57dd90dcb40 100644 --- a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml +++ b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml @@ -282,9 +282,6 @@ { "name": "AdditionalStorageConfig" }, - { - "name": "BootImageSkewEnforcement" - }, { "name": "BuildCSIVolumes" }, diff --git a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml index dd0087917a5..be90935d1de 100644 --- a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml +++ b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml @@ -126,9 +126,6 @@ { "name": "AzureMultiDisk" }, - { - "name": "BootImageSkewEnforcement" - }, { "name": "BootcNodeManagement" },