OCPBUGS-35262: Do not create firewall rules for xpn installs #8801

barbacbd · 2024-08-06T14:57:43Z

** Bootstrap firewall rules should not be created when the user does not have the permission to do so (during capg xpn installs).

openshift-ci-robot · 2024-08-06T14:57:51Z

@barbacbd: This pull request references Jira Issue OCPBUGS-35262, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.17.0) matches configured target version for branch (4.17.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @jianli-wei

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

** Bootstrap firewall rules should not be created when the user does not have the permission to do so (during capg xpn installs).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

barbacbd · 2024-08-06T14:58:01Z

/cc @patrickdillon
/cc @r4f4
/cc @bfournie

barbacbd · 2024-08-06T14:58:18Z

/label platform/google

pkg/infrastructure/gcp/clusterapi/firewallrules.go

bfournie · 2024-08-06T19:00:27Z

/lgtm

r4f4

/approve

/hold
Remove when you're happy the xpn CI job result.

openshift-ci · 2024-08-06T21:30:27Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: r4f4

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [r4f4]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

patrickdillon · 2024-08-07T15:38:07Z

/test e2e-gcp-ovn-xpn

Previous test was on terraform, default should be on capg now.

patrickdillon · 2024-08-07T15:43:03Z

pkg/infrastructure/gcp/clusterapi/firewallrules.go

@@ -215,31 +215,42 @@ func deleteFirewallRule(ctx context.Context, name, projectID string) error {
 	return nil
 }

+func hasFirewallPermission(ctx context.Context, projectID string) (bool, error) {
+	client, err := gcpconfig.NewClient(context.Background())


nit: there is a ctx passed into this function, so creating a new background context should not be necessary. The calling function should not be setting timeouts or limiting the ctx passed in so that it cannot be used to create the client.

bfournie · 2024-08-08T13:44:17Z

/lgtm

barbacbd · 2024-08-08T14:10:51Z

/hold cancel

openshift-ci-robot · 2024-08-09T14:01:39Z

@barbacbd: This pull request references Jira Issue OCPBUGS-35262, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.18.0) matches configured target version for branch (4.18.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @jianli-wei

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

barbacbd · 2024-08-09T14:02:08Z

/jira backport release-4.17

openshift-ci-robot · 2024-08-09T14:11:07Z

@barbacbd: The following backport issues have been created:

OCPBUGS-38244 for branch release-4.17

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick release-4.17

In response to this:

/jira backport release-4.17

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-cherrypick-robot · 2024-08-09T14:11:10Z

@openshift-ci-robot: once the present PR merges, I will cherry-pick it on top of release-4.17 in a new PR and assign it to you.

In response to this:

@barbacbd: The following backport issues have been created:

OCPBUGS-38244 for branch release-4.17

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick release-4.17

In response to this:

/jira backport release-4.17

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

barbacbd · 2024-08-09T19:10:56Z

/test e2e-gcp-ovn-xpn

barbacbd · 2024-08-12T11:55:31Z

@patrickdillon The failure in e2e-gcp-ovn-xpn is looking for compute.firewalls.get permission in another cluster component. I don't think that this is should block this PR, WDYT?

patrickdillon · 2024-08-12T14:10:06Z

@patrickdillon The failure in e2e-gcp-ovn-xpn is looking for compute.firewalls.get permission in another cluster component. I don't think that this is should block this PR, WDYT?

Depending on how that test is setup, the issue is addressed by #8815

barbacbd · 2024-08-13T13:59:23Z

/hold cancel

barbacbd · 2024-08-13T15:46:44Z

/retest-required

barbacbd · 2024-08-13T16:05:28Z

/test okd-scos-e2e-vsphere-ovn

openshift-ci · 2024-08-13T16:05:32Z

@barbacbd: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

/test altinfra-images
/test aro-unit
/test e2e-agent-compact-ipv4
/test e2e-aws-ovn
/test e2e-aws-ovn-edge-zones-manifest-validation
/test e2e-aws-ovn-upi
/test e2e-azure-ovn
/test e2e-azure-ovn-upi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upi
/test e2e-metal-ipi-ovn-ipv6
/test e2e-openstack-ovn
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi
/test gofmt
/test golint
/test govet
/test images
/test integration-tests
/test okd-images
/test okd-unit
/test okd-verify-codegen
/test openstack-manifests
/test shellcheck
/test terraform-images
/test terraform-verify-vendor
/test tf-lint
/test unit
/test verify-codegen
/test verify-vendor
/test yaml-lint

The following commands are available to trigger optional jobs:

/test altinfra-e2e-aws-custom-security-groups
/test altinfra-e2e-aws-ovn
/test altinfra-e2e-aws-ovn-fips
/test altinfra-e2e-aws-ovn-imdsv2
/test altinfra-e2e-aws-ovn-localzones
/test altinfra-e2e-aws-ovn-proxy
/test altinfra-e2e-aws-ovn-public-ipv4-pool
/test altinfra-e2e-aws-ovn-shared-vpc
/test altinfra-e2e-aws-ovn-shared-vpc-local-zones
/test altinfra-e2e-aws-ovn-shared-vpc-wavelength-zones
/test altinfra-e2e-aws-ovn-single-node
/test altinfra-e2e-aws-ovn-wavelengthzones
/test altinfra-e2e-azure-capi-ovn
/test altinfra-e2e-azure-ovn-shared-vpc
/test altinfra-e2e-gcp-capi-ovn
/test altinfra-e2e-gcp-ovn-byo-network-capi
/test altinfra-e2e-gcp-ovn-secureboot-capi
/test altinfra-e2e-gcp-ovn-xpn-capi
/test altinfra-e2e-ibmcloud-capi-ovn
/test altinfra-e2e-nutanix-capi-ovn
/test altinfra-e2e-openstack-capi-ccpmso
/test altinfra-e2e-openstack-capi-ccpmso-zone
/test altinfra-e2e-openstack-capi-dualstack
/test altinfra-e2e-openstack-capi-dualstack-upi
/test altinfra-e2e-openstack-capi-dualstack-v6primary
/test altinfra-e2e-openstack-capi-externallb
/test altinfra-e2e-openstack-capi-nfv-intel
/test altinfra-e2e-openstack-capi-ovn
/test altinfra-e2e-openstack-capi-proxy
/test altinfra-e2e-powervs-capi-ovn
/test altinfra-e2e-vsphere-capi-multi-vcenter-ovn
/test altinfra-e2e-vsphere-capi-ovn
/test altinfra-e2e-vsphere-capi-static-ovn
/test altinfra-e2e-vsphere-capi-zones
/test azure-ovn-marketplace-images
/test e2e-agent-compact-ipv4-add-nodes
/test e2e-agent-compact-ipv4-appliance-diskimage
/test e2e-agent-compact-ipv4-none-platform
/test e2e-agent-ha-dualstack
/test e2e-agent-sno-ipv4-pxe
/test e2e-agent-sno-ipv6
/test e2e-aws-overlay-mtu-ovn-1200
/test e2e-aws-ovn-custom-iam-profile
/test e2e-aws-ovn-edge-zones
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-heterogeneous
/test e2e-aws-ovn-imdsv2
/test e2e-aws-ovn-proxy
/test e2e-aws-ovn-public-subnets
/test e2e-aws-ovn-shared-vpc-custom-security-groups
/test e2e-aws-ovn-shared-vpc-edge-zones
/test e2e-aws-ovn-single-node
/test e2e-aws-ovn-techpreview
/test e2e-aws-ovn-upgrade
/test e2e-aws-ovn-workers-rhel8
/test e2e-aws-upi-proxy
/test e2e-azure-ovn-resourcegroup
/test e2e-azure-ovn-shared-vpc
/test e2e-azure-ovn-techpreview
/test e2e-azurestack
/test e2e-azurestack-upi
/test e2e-crc
/test e2e-external-aws
/test e2e-external-aws-ccm
/test e2e-gcp-ovn-byo-vpc
/test e2e-gcp-ovn-heterogeneous
/test e2e-gcp-ovn-techpreview
/test e2e-gcp-ovn-xpn
/test e2e-gcp-secureboot
/test e2e-gcp-upgrade
/test e2e-gcp-upi-xpn
/test e2e-ibmcloud-ovn
/test e2e-metal-assisted
/test e2e-metal-ipi-ovn
/test e2e-metal-ipi-ovn-dualstack
/test e2e-metal-ipi-ovn-swapped-hosts
/test e2e-metal-ipi-ovn-virtualmedia
/test e2e-metal-single-node-live-iso
/test e2e-nutanix-ovn
/test e2e-openstack-ccpmso
/test e2e-openstack-ccpmso-zone
/test e2e-openstack-dualstack
/test e2e-openstack-dualstack-upi
/test e2e-openstack-externallb
/test e2e-openstack-nfv-intel
/test e2e-openstack-proxy
/test e2e-vsphere-multi-vcenter-ovn
/test e2e-vsphere-ovn-techpreview
/test e2e-vsphere-ovn-upi-zones
/test e2e-vsphere-ovn-zones
/test e2e-vsphere-ovn-zones-techpreview
/test e2e-vsphere-static-ovn
/test okd-e2e-agent-compact-ipv4
/test okd-e2e-agent-ha-dualstack
/test okd-e2e-agent-sno-ipv6
/test okd-e2e-aws-ovn
/test okd-e2e-aws-ovn-upgrade
/test okd-e2e-gcp
/test okd-e2e-gcp-ovn-upgrade
/test okd-e2e-vsphere
/test okd-scos-images
/test tf-fmt

Use /test all to run the following jobs that were automatically triggered:

pull-ci-openshift-installer-master-altinfra-images
pull-ci-openshift-installer-master-aro-unit
pull-ci-openshift-installer-master-e2e-aws-ovn
pull-ci-openshift-installer-master-e2e-gcp-ovn
pull-ci-openshift-installer-master-e2e-gcp-ovn-byo-vpc
pull-ci-openshift-installer-master-e2e-gcp-ovn-xpn
pull-ci-openshift-installer-master-e2e-gcp-secureboot
pull-ci-openshift-installer-master-gofmt
pull-ci-openshift-installer-master-golint
pull-ci-openshift-installer-master-govet
pull-ci-openshift-installer-master-images
pull-ci-openshift-installer-master-okd-unit
pull-ci-openshift-installer-master-okd-verify-codegen
pull-ci-openshift-installer-master-shellcheck
pull-ci-openshift-installer-master-tf-fmt
pull-ci-openshift-installer-master-tf-lint
pull-ci-openshift-installer-master-unit
pull-ci-openshift-installer-master-verify-codegen
pull-ci-openshift-installer-master-verify-vendor
pull-ci-openshift-installer-master-yaml-lint

In response to this:

/test okd-scos-e2e-vsphere-ovn

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

** Bootstrap firewall rules should not be created when the user does not have the permission to do so (during capg xpn installs).

bfournie · 2024-08-14T20:05:52Z

/lgtm

openshift-ci-robot · 2024-08-14T20:50:26Z

/retest-required

Remaining retests: 0 against base HEAD aafbe71 and 2 for PR HEAD 76e9633 in total

openshift-ci-robot · 2024-08-15T02:50:25Z

/retest-required

Remaining retests: 0 against base HEAD 95dadc7 and 1 for PR HEAD 76e9633 in total

openshift-ci · 2024-08-15T08:24:30Z

@barbacbd: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/okd-scos-e2e-vsphere-ovn	`b84f59b`	link	false	`/test okd-scos-e2e-vsphere-ovn`
ci/prow/e2e-gcp-ovn-xpn	`76e9633`	link	false	`/test e2e-gcp-ovn-xpn`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot · 2024-08-15T08:29:17Z

@barbacbd: Jira Issue OCPBUGS-35262: All pull requests linked via external trackers have merged:

Jira Issue OCPBUGS-35262 has been moved to the MODIFIED state.

In response to this:

** Bootstrap firewall rules should not be created when the user does not have the permission to do so (during capg xpn installs).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-cherrypick-robot · 2024-08-15T08:30:10Z

@openshift-ci-robot: new pull request created: #8847

In response to this:

@barbacbd: The following backport issues have been created:

OCPBUGS-38244 for branch release-4.17

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick release-4.17

In response to this:

/jira backport release-4.17

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-bot · 2024-08-15T13:14:45Z

[ART PR BUILD NOTIFIER]

Distgit: ose-installer-altinfra
This PR has been included in build ose-installer-altinfra-container-v4.18.0-202408151144.p0.gf4c89c6.assembly.stream.el9.
All builds following this will include this PR.

openshift-bot · 2024-08-15T13:23:46Z

[ART PR BUILD NOTIFIER]

Distgit: ose-installer-terraform-providers
This PR has been included in build ose-installer-terraform-providers-container-v4.18.0-202408151144.p0.gf4c89c6.assembly.stream.el9.
All builds following this will include this PR.

openshift-bot · 2024-08-15T13:26:45Z

[ART PR BUILD NOTIFIER]

Distgit: ose-baremetal-installer
This PR has been included in build ose-baremetal-installer-container-v4.18.0-202408151144.p0.gf4c89c6.assembly.stream.el9.
All builds following this will include this PR.

openshift-bot · 2024-08-15T14:53:52Z

[ART PR BUILD NOTIFIER]

Distgit: ose-installer-artifacts
This PR has been included in build ose-installer-artifacts-container-v4.18.0-202408151144.p0.gf4c89c6.assembly.stream.el9.
All builds following this will include this PR.

openshift-ci bot requested a review from jianli-wei August 6, 2024 14:58

openshift-ci bot requested review from bfournie, patrickdillon and r4f4 August 6, 2024 14:58

openshift-ci bot added the platform/google label Aug 6, 2024

openshift-ci bot requested review from jhixson74 and rwsu August 6, 2024 15:03

bfournie reviewed Aug 6, 2024

View reviewed changes

pkg/infrastructure/gcp/clusterapi/firewallrules.go Outdated Show resolved Hide resolved

pkg/infrastructure/gcp/clusterapi/firewallrules.go Outdated Show resolved Hide resolved

pkg/infrastructure/gcp/clusterapi/firewallrules.go Outdated Show resolved Hide resolved

barbacbd force-pushed the OCPBUGS-35262-bootstrap-perm branch from 25077f6 to 40da75d Compare August 6, 2024 18:24

openshift-ci bot assigned bfournie Aug 6, 2024

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Aug 6, 2024

r4f4 reviewed Aug 6, 2024

View reviewed changes

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 6, 2024

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 6, 2024

patrickdillon reviewed Aug 7, 2024

View reviewed changes

barbacbd force-pushed the OCPBUGS-35262-bootstrap-perm branch from 40da75d to 262fcc9 Compare August 8, 2024 13:41

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Aug 8, 2024

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Aug 8, 2024

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 8, 2024

openshift-ci-robot added the jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. label Aug 9, 2024

openshift-ci-robot removed the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Aug 9, 2024

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 13, 2024

OCPBUGS-35262: Do not create firewall rules for xpn installs

76e9633

** Bootstrap firewall rules should not be created when the user does not have the permission to do so (during capg xpn installs).

barbacbd force-pushed the OCPBUGS-35262-bootstrap-perm branch from b84f59b to 76e9633 Compare August 14, 2024 11:46

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Aug 14, 2024

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Aug 14, 2024

openshift-merge-bot bot merged commit f4c89c6 into openshift:master Aug 15, 2024
20 of 21 checks passed

openshift-cherrypick-robot mentioned this pull request Aug 15, 2024

[release-4.17] OCPBUGS-38244: Do not create firewall rules for xpn installs #8847

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OCPBUGS-35262: Do not create firewall rules for xpn installs #8801

OCPBUGS-35262: Do not create firewall rules for xpn installs #8801

barbacbd commented Aug 6, 2024

openshift-ci-robot commented Aug 6, 2024

barbacbd commented Aug 6, 2024

barbacbd commented Aug 6, 2024

bfournie commented Aug 6, 2024

r4f4 left a comment

openshift-ci bot commented Aug 6, 2024

patrickdillon commented Aug 7, 2024

patrickdillon Aug 7, 2024

bfournie commented Aug 8, 2024

barbacbd commented Aug 8, 2024

openshift-ci-robot commented Aug 9, 2024

barbacbd commented Aug 9, 2024

openshift-ci-robot commented Aug 9, 2024

openshift-cherrypick-robot commented Aug 9, 2024

barbacbd commented Aug 9, 2024

barbacbd commented Aug 12, 2024

patrickdillon commented Aug 12, 2024

barbacbd commented Aug 13, 2024

barbacbd commented Aug 13, 2024

barbacbd commented Aug 13, 2024

openshift-ci bot commented Aug 13, 2024

bfournie commented Aug 14, 2024

openshift-ci-robot commented Aug 14, 2024

openshift-ci-robot commented Aug 15, 2024

openshift-ci bot commented Aug 15, 2024

openshift-ci-robot commented Aug 15, 2024

openshift-cherrypick-robot commented Aug 15, 2024

openshift-bot commented Aug 15, 2024

openshift-bot commented Aug 15, 2024

openshift-bot commented Aug 15, 2024

openshift-bot commented Aug 15, 2024

OCPBUGS-35262: Do not create firewall rules for xpn installs #8801

OCPBUGS-35262: Do not create firewall rules for xpn installs #8801

Conversation

barbacbd commented Aug 6, 2024

openshift-ci-robot commented Aug 6, 2024

barbacbd commented Aug 6, 2024

barbacbd commented Aug 6, 2024

bfournie commented Aug 6, 2024

r4f4 left a comment

Choose a reason for hiding this comment

openshift-ci bot commented Aug 6, 2024

patrickdillon commented Aug 7, 2024

patrickdillon Aug 7, 2024

Choose a reason for hiding this comment

bfournie commented Aug 8, 2024

barbacbd commented Aug 8, 2024

openshift-ci-robot commented Aug 9, 2024

barbacbd commented Aug 9, 2024

openshift-ci-robot commented Aug 9, 2024

openshift-cherrypick-robot commented Aug 9, 2024

barbacbd commented Aug 9, 2024

barbacbd commented Aug 12, 2024

patrickdillon commented Aug 12, 2024

barbacbd commented Aug 13, 2024

barbacbd commented Aug 13, 2024

barbacbd commented Aug 13, 2024

openshift-ci bot commented Aug 13, 2024

bfournie commented Aug 14, 2024

openshift-ci-robot commented Aug 14, 2024

openshift-ci-robot commented Aug 15, 2024

openshift-ci bot commented Aug 15, 2024

openshift-ci-robot commented Aug 15, 2024

openshift-cherrypick-robot commented Aug 15, 2024

openshift-bot commented Aug 15, 2024

openshift-bot commented Aug 15, 2024

openshift-bot commented Aug 15, 2024

openshift-bot commented Aug 15, 2024